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October  19,  2001 

MEMORANDUM  FOR  UNDER  SECRETARY  OF  DEFENSE  FOR  ACQUISITION, 

TECHNOLOGY,  AND  LOGISTICS 
DIRECTOR,  DEFENSE  HNANCE  AND  ACCOUNTING 
SERVICE 

NAVAL  INSPECTOR  GENERAL 

SUBJECT:  Audit  Report  on  Controls  Over  the  Computerized  Accounts  Payable 
System  at  Defense  Finance  and  Accounting  Service  Kansas  City 
(Report  No.  D-2002-008) 


We  are  providing  this  report  for  review  and  comment.  This  is  the  first  report  in 
a  series  related  to  controls  over  the  Computerized  Accounts  Payable  System.  We 
considered  management  comments  on  a  toft  of  this  report  when  preparing  the  final 
report. 


DoD  Directive  7650.3  requires  that  all  recommendations  be  resolved  promptly. 
The  Director,  Defense  Procurement,  comments  were  responsive.  However,  the 
Director,  Defense  Procurement,  did  not  provide  a  completion  date  for  corrective 
actions.  The  Director,  Commercial  Pay  Services  for  the  Defense  Finance  and 
Accounting  Service,  comments  were  generally  responsive  except  for  Recommendations 
A.6.,  B.2.,  B.3.C.,  and  C.6.  We  request  additional  comments  on  those 
recommendations.  The  Marine  Coips  did  not  provide  comments  to  the  draft  report. 
Therefore,  we  request  that  die  Marine  Corps  provide  comments  on 
Recommendations  B.3.  and  B.4.  We  request  that  management  provide  all  comments 
by  December  19,  2001. 

We  appreciate  the  courtesies  extended  to  the  audit  staff.  For  additional 
information  on  this  report,  please  contact  Mr.  Marvin  L.  Peek  at  (703)  604-9587 
(DSN  664-9587)  (mpeek@dodig.osd.mil)  or  Mr.  Carmelo  G.  Ventimiglia  at 
(317)  510-3852  (DSN  699-3852)  (cventimiglia@dodig.osd.mil).  See  Appendix  E  for 
the  report  distribution.  The  audit  team  members  are  listed  inside  the  back  cover. 


Thomas  F.  Gimble 
Acting 

Deputy  Assistant  Inspector  General 
for  Auditing 
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(Project  No.  D2000FI-0248) 

Controls  Over  the  Computerized  Accounts  Payable  System  at 
Defense  Finance  and  Accounting  Service  Kansas  City 

Executive  Summary 


Introduction.  Serious  internal  eontrol  weaknesses  have  been  reported  over  the  years  in 
DoD  payment  proeesses  and  systems.  The  Defense  Finanee  and  Aeeounting  Serviee 
(DFAS)  Kansas  City  used  the  Computerized  Aeeounts  Payable  System  for  Windows 
(CAPS[W])  to  make  vendor  payments  to  Marine  Corps  eustomers.  During  FY  2000, 
75,861  vendor  payments,  valued  at  $1.2  billion,  were  made  for  Marine  Corps 
eustomers  using  CAPS(W).  On  April  1,  2001,  the  Direetor,  DFAS,  eapitalized  all 
eommereial  payment  resourees  under  the  Direetor,  Commereial  Pay  Serviees.  This  is 
the  first  in  a  series  of  audit  reports  addressing  the  eontrols  over  the  Computerized 
Aeeounts  Payable  System. 

Objectives.  Our  objeetives  were  to  evaluate  the  eontrols  assoeiated  with  making 
payments  using  the  Computerized  Aeeounts  Payable  System  and  progress  in 
transitioning  to  the  Defense  Proeurement  Payment  System.  This  report  foeuses  on  the 
eontrols  assoeiated  with  making  vendor  payments.  We  also  evaluated  the  effeetiveness 
of  the  management  eontrol  program  as  it  related  to  making  vendor  payments  using  the 
Computerized  Aeeounts  Payable  System. 

Results.  DFAS  Kansas  City  took  actions  to  systematically  segregate  access  within 
CAPS(W).  However,  two  systems  management  personnel  had  unrestricted  access  to 
CAPS(W)  and  other  system  users  performed  functions  that  required  further  segregation. 
When  coupled  with  other  system  deficiencies  and  control  weatoesses,  CAPS(W)  was 
vulnerable  to  improper  and  unauthorized  use  (finding  A). 

DFAS  Kansas  City  made  17,983  payments  from  May  1  through  July  31,  2000,  and 
approximately  16,605  of  these  payments  did  not  meet  all  the  documentation  or  other 
requirements  imposed  by  0MB  regulations  implementing  the  Prompt  Payment  Act. 

The  fact  that  a  payment  was  not  supported  did  not  mean  that  the  payment  was  invalid  or 
fraudulent,  but  indicated  management’s  failure  to  enforce  the  requirements  necessary 
for  proper  support.  As  a  result,  DFAS  and  Marine  Corps  managers  assumed  an 
increased  risk  that  payments  were  not  being  made  in  compliance  with  the  Prompt 
Payment  Act  and  that  improper  payments  may  have  been  made  (finding  B). 

The  structure  and  business  practices  of  the  vendor  payment  office  at  DFAS  Kansas  City 
did  not  provide  efficient  and  effective  controls  over  vendor  payments.  As  a  result, 
DFAS  Kansas  City  did  not  ensure  that  improperly  supported  and  erroneous  payments 


would  be  detected  and  corrected  before  payment  (finding  C).  See  Appendix  A  for 
details  on  the  management  control  program  as  it  relates  to  controls  over  vendor 
payments. 

Summary  of  Recommendations.  We  recommend  that  the  Under  Secretary  of  Defense 
for  Acquisition,  Technology,  and  Logistics,  require  the  use  of  DD  Form  250, 

“Material  Inspection  and  Receiving  Report,”  as  the  primary  means  for  documenting 
receipt  and  acceptance  of  goods  and  services.  We  recommend  that  the  Director, 
Commercial  Pay  Services,  develop  compensating  controls  and  change  the  business 
structure  and  practices  at  DFAS  Kansas  City  for  making  payments  using  CAPS(W). 

We  also  recommend  the  removal  of  remote  access  to  update  and  certify  information  in 
CAPS(W).  We  also  recommend  that  the  Director,  Commercial  Pay  Services,  issue 
interim  guidance  that  discontinues  exceptions  to  the  requirements  for  a  proper  invoice, 
specifies  what  a  receiving  report  must  contain  to  properly  support  a  payment,  and 
standardizes  the  rules  for  making  properly  supported  miscellaneous  payments.  We 
recommend  that  the  Director,  Commercial  Pay  Services,  in  conjunction  with  the 
Marine  Corps,  develop  stringent  procedures  for  accepting  invoice  receipt  dates  affixed 
outside  the  payment  office,  return  all  invoices  to  vendors  that  do  not  meet  payment 
requirements,  and  issue  guidance  to  Marine  Corps  activities  identifying  the  standards 
for  proper  receipt  and  acceptance  of  goods  and  services.  We  recommend  that  the 
Deputy  Chief  of  Staff  for  Installations  and  Logistics,  Marine  Corps,  ensures  that  all 
contracting  documents  provide  the  information  necessary  for  making  proper  payments. 

Management  Comments.  The  Director,  Defense  Procurement,  concurred  with  the 
recommendation  to  require  the  use  of  DD  Form  250  as  the  primary  means  of 
documenting  receipt  and  acceptance.  The  Director,  Commercial  Pay  Services,  agreed 
to  develop  a  standard  business  structure  and  more  stringent  procedures  for  accepting 
invoice  receipt  dates,  returning  invoices,  and  entering  data  into  CAPS(W).  The 
Director,  Commercial  Pay  Services,  also  agreed  to  review  system  access  profiles  to 
ensure  that  they  properly  segregate  duties.  The  Director,  Commercial  Pay  Services, 
partially  agreed  with  the  need  to  provide  guidance  and  training  to  Marine  Corps 
activities  on  receiving  reports,  improve  certification  of  payments,  perform  more 
frequent  post-payment  reviews,  and  provide  interim  guidance  on  requirements  for 
proper  invoices  and  receiving  reports.  The  Director,  Commercial  Pay  Services,  did  not 
agree  with  the  need  to  remove  remote  access  from  Marine  Corps  activities.  The 
Marine  Corps  did  not  provide  comments  to  the  draft  of  the  final  report.  See  the 
Finding  section  of  the  report  for  a  discussion  of  management  comments  and  the 
Management  Comments  section  for  a  complete  text  of  the  comments. 

Audit  Response.  Comments  from  the  Director,  Defense  Procurement,  were 
responsive.  We  request  that  the  Director,  Defense  Procurement,  provide  an  estimated 
completion  date  for  the  corrective  action.  Comments  from  the  Director,  Commercial 
Pay  Services,  were  generally  responsive.  We  request  that  the  Director,  Commercial 
Pay  Services,  reconsider  her  position  on  the  need  to  remove  access  from  Marine  Corps 
activities  until  CAPS(W)  can  provide  proper  segregation  of  duties  and  security  over 
remotely  entered  data.  We  request  that  Director,  Defense  Procurement;  DFAS;  and  the 
Marine  Corps  provide  comments  on  the  final  report  by  December  19,  2001. 
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Background 


Vendor  Payments.  Vendor  payments  are  made  for  operational  support  sueh  as 
utilities,  medieal  serviees,  and  administrative  supplies  and  serviees.  The  eurrent 
vendor  payment  proeess  depends  on  the  reeeipt  of  various  hard-eopy  doeuments. 
As  a  general  rule,  payments  must  be  supported  by  an  obligating  doeument 
(eontraet,  purehase  order,  or  other  doeument  obligating  DoD  to  pay  for  goods 
or  serviees),  an  invoiee,  and  a  reeeiving  report.  For  most  payments  made  for 
Marine  Corps  eustomers,  teehnieians  at  Defense  Finanee  and  Aeeounting 
Serviee  (DFAS)  Kansas  City,  Kansas  City,  Missouri,  review  supporting 
doeuments  for  aeeuraey  and  eompleteness.  The  information  is  entered  into  the 
Computerized  Aeeounts  Payable  System  for  Windows  (CAPS[W])  to  ereate  a 
payment  voueher,  whieh  is  then  approved  for  payment  by  a  eertifying  offieial. 
Certifying  offieers  should  eompare  the  payment  vouehers  to  the  supporting 
invoiees,  reeeiving  reports,  and  eontraet  or  obligation  doeuments  to  ensure  the 
aeeuraey  of  the  payment  information  before  disbursement.  For  utility  payments, 
DFAS  Kansas  City  transferred  the  funetion  of  reviewing  doeuments  and 
eertifying  payments  to  Marine  Corps  installations.  Following  eertifieation,  the 
payment  information  is  loaded  into  the  disbursing  system.  The  disbursing 
system  uses  the  payment  transaetions  generated  by  CAPS(W)  to  make 
disbursements. 

Inspector  General,  DoD,  Report.  At  the  request  of  Senator  Charles  E. 
Grassley,  the  Inspeetor  General,  DoD,  audited  the  results  of  the  aetions  taken 
within  the  Air  Foree  vendor  payment  network  to  eorreet  problems  previously 
reported.  Inspeetor  General,  DoD,  Report  No.  D-2000-139,  “Controls  Over 
the  Integrated  Aeeounts  Payable  System,”  June  5,  2000,  reported  that 
DFAS  Denver,  Denver,  Colorado,  established  systematie  eontrols  to  segregate 
duties  and  redueed  aeeess  to  the  Integrated  Aeeounts  Payable  System,  the 
system  used  to  proeess  Air  Foree  payments.  However,  DFAS  Denver  needed  to 
reassess  the  system  aeeess  given  to  users,  espeeially  those  outside  their  field 
sites.  Giving  more  people  aeeess  than  was  neeessary  inereased  the  risk  of 
unwarranted  and  unauthorized  aeeess  and  the  likelihood  that  unsupported  and 
improper  payments  would  be  made.  Other  system  weaknesses  eontributed  to 
unauthorized  Integrated  Aeeounts  Payable  System  aeeess  and  the  ability  to 
eireumvent  payment  of  interest  to  vendors  as  required  by  the  Prompt  Payment 
Aet  (PPA). 

Automated  System  for  Making  Marine  Corps  Vendor  Payments.  DFAS 
Kansas  City  is  responsible  for  the  aeeounting,  disbursing,  eolleeting,  and 
finaneial  reporting  of  the  Marine  Corps.  DFAS  Kansas  City  uses  CAPS(W)  to 
proeess  Marine  Corps  vendor  payments.  The  system  eomputes  the  payment  due 
dates,  payment  amounts,  and  interest  payments.  CAPS(W)  reeeives  data  from 
manual  sourees  and  from  interfaees  with  automated  systems  sueh  as  the  standard 
proeurement  system.  CAPS(W)  uses  both  automated  and  manual  eontrols  to 
maintain  aeeurate  and  eomplete  data.  DFAS  originally  planned  to  replaee 
CAPS(W)  at  DFAS  Kansas  City  with  the  Defense  Proeurement  Payment  System 
(DPPS)  in  Deeember  2001.  However,  the  implementation  date  has  slipped  and 
a  revised  date  had  not  been  set. 
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Realignment  of  Vendor  Payment  Operations.  On  March  29,  2001,  the 
Director,  DFAS,  announced  the  capitalization  of  all  commercial  payment 
resources  under  the  Commercial  Pay  Business  Line.  The  Director,  Commercial 
Pay  Services,  is  responsible  for  the  commercial  pay  business  line.  This  business 
line  is  comprised  of  two  product  lines  (contract  pay  and  vendor  pay).  The 
Vendor  Pay  Product  Line  encompasses  entitlement  determination  for  contracts 
not  administered  by  Defense  Contract  Management  Agency,  transportation 
payments,  and  miscellaneous  payments  to  businesses  and  individuals.  All 
vendor  payment  functions  at  DFAS  Kansas  City  have  been  realigned  under  the 
U.S.  Marine  Corps  and  Defense  Agency  Support  Directorate  of  the  Vendor  Pay 
Product  Line. 

Objectives 


Our  objectives  were  to  evaluate  the  controls  associated  with  making  payments 
using  the  CAPS  and  progress  in  transitioning  to  DPPS.  This  report  focuses  on 
the  controls  associated  with  making  vendor  payments.  We  also  evaluated  the 
effectiveness  of  the  management  control  program  as  it  related  to  making  vendor 
payments  using  CAPS.  See  Appendix  A  for  a  discussion  of  the  audit  scope  and 
methodology  and  our  review  of  the  management  control  program.  See 
Appendix  B  for  a  summary  of  prior  coverage. 
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A.  System  Access  Controls 

DFAS  Kansas  City  took  actions  to  systematically  segregate  aeeess  within 
CAPS(W).  However,  systems  management  personnel  had  unrestrieted  aeeess 
to  CAPS(W)  and  other  system  users  performed  funetions  that  required  further 
segregation.  This  oeeurred  beeause; 

•  aeeess  profiles  were  not  eentrally  developed  and  eontrolled, 

•  aeeess  profiles  did  not  fully  segregate  user  funetions,  and 

•  remote  user  aeeess  was  not  monitored. 

When  eoupled  with  other  system  defieieneies  and  eontrol  weaknesses, 
CAPS(W)  was  vulnerable  to  improper  and  unauthorized  use. 

Direction  and  Guidance 


In  August  1998,  the  Direetor,  DFAS,  direeted  all  DFAS  vendor  payment  offiees  to 
perform  a  eomprehensive  review  of  the  segregation  of  duties  within  their  vendor 
payment  systems.  In  General  Aeeounting  Offiee  (GAO)  Report 
No.  GAO/AIMD-98-274,  “Improvements  Needed  in  Air  Foree  Vendor  Payment 
Systems  and  Controls,”  September  28,  1998,  GAO  reeommended  that  the  Direetor, 
DFAS,  strengthen  payment  proeessing  eontrols  by  establishing  separate 
organizational  responsibilities  for  entering  payment  data  and  revising  vendor 
payment  aeeess  levels  to  eorrespond  with  the  new  strueture.  GAO  Report  No. 
GAO/AIMD-00-2 1.3.1,  “Standards  for  Internal  Control  in  the  Federal 
Government,”  November  1,  1999,  requires  aeeess  restrietions  and  segregation  of 
key  duties  in  authorizing,  proeessing,  reeording,  and  reviewing  transaetions. 

DFAS  Kansas  City  Databases 


Main  Database.  DFAS  Kansas  City  maintained  two  separate  CAPS(W)  databases 
for  making  Marine  Corps  vendor  payments.  DFAS  Kansas  City  vendor  payment 
personnel  used  one  database  to  make  a  majority  of  the  Marine  Corps  payments.  As 
of  Oetober  30,  2000,  aeeess  to  this  database  was  granted  to  61  DFAS  Kansas  City 
vendor  payment  personnel  and  19  Finaneial  Systems  Direetorate  (FSD)  personnel  at 
DFAS  Indianapolis.  The  FSD  personnel  provide  system  maintenanee  and  support 
funetions  for  CAPS(W)  users.  The  ability  to  update  data  within  CAPS(W)  and 
inquire  about  the  status  of  payments  is  eontrolled  by  aeeess  profiles. 

Database  for  Making  Utility  Payments.  DFAS  Kansas  City  ereated  a  seeond 
database  to  allow  for  the  payment  of  utility  bills  by  personnel  at  13  Marine  Corps 
installations.  Utility  eompanies  submitted  eleetrieity,  gas,  water,  and  sewer  bills.  In 
February  2000,  DFAS  Kansas  City  issued  guidanee  stating  that  remote  users  would 
be  allowed  to  proeess  utility  payments  direetly  in  CAPS(W).  Aeeess  to  the  seeond 
database  was  granted  to  44  Marine  Corps  personnel  at  the  13  installations  and 
2  individuals  assigned  to  the  DFAS  Kansas  City  systems  offiee.  Eaeh  person  had  the 
ability  to  proeess  the  information  needed  to  make  payments.  Remote  users  entered 


3 


the  information  supporting  the  payment  (obligation  doeument,  invoiee,  and  reeeiving 
report)  into  CAPS(W),  eertified  the  payment,  and  then  sent  DFAS  Kansas  City  a 
signed  voueher  worksheet.  DFAS  Kansas  City  personnel  eompared  the  signature  on 
the  voueher  worksheet  to  a  signature  eard  on  file  and  the  payment  was  uploaded  to 
the  disbursing  system. 

System  Access  to  the  Main  Database 


In  January  2000,  DFAS  Kansas  City  signifieantly  improved  the  segregation  of  duties 
within  the  vendor  payment  offiee  by  separating  the  funetional  eapabilities  assigned  to 
12  aeeess  profiles.  Aeeess  was  divided  by  the  ability  to  enter  invoiee  and  reeeipt 
data,  purehase  order  information,  vendor  maintenanee  data,  data  needed  to  make 
miseellaneous  payments,  and  the  ability  to  eertify  payments.  Table  1  shows  eaeh  of 
the  12  aeeess  profiles  for  the  80  personnel  granted  aeeess  to  the  database  used  to 
make  the  majority  of  the  Marine  Corps  payments.  The  table  also  identifies  the 
funetional  eapabilities  assoeiated  with  eaeh  aeeess  profile. 
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Table  1.  Access  to  Main  DFAS  Kansas  City  Database 

Functional  Capability 

Profile 

Number  of 
Individuals 

Invoice  and 
Receiving 
Reports 

Miscellaneous 

Payments 

Purchase 

Order 

Maintenance 

Vendor 

Maintenance 

Certify 

All 

2 

Air 

Accessible^ 

All 

All 

Accessible 

Citibank^ 

5 

All 

Accessible 

All 

None 

None 

Citibank 

Lead 

1 

Inquiry* 

None 

Inquiry 

Inquiry 

Accessible 

Contract 

Inpnt 

6 

Inquiry 

None 

All 

All 

None 

Examiner  1 

20 

All 

Accessible 

Inquiry 

Inquiry 

None 

Financial 

Analyst 

1 

Inquiry 

None 

Inquiry 

Inquiry 

None 

FSD 

Snpport 

18 

All 

Accessible 

All 

Inquiry 

None 

Lead 

5 

Inquiry 

None 

Inquiry 

Inquiry 

Accessible 

Lead  1 

1 

Inquiry 

None 

Inquiry 

Inquiry 

Accessible 

Read  Only 

19 

None 

None 

None 

None 

None 

Reports 

1 

None 

None 

Inquiry 

Inquiry 

None 

Snpport 

Team 

Leader 

1 

Inquiry 

None 

All 

All 

None 

1.  “All”  means  the  ability  to  add,  delete,  inquire,  and  update  within  a  function. 

2.  Related  to  the  Miscellaneous  Payments  function,  “accessible”  means  the  ability  to  enter  all  the  data  for 
processing  a  miscellaneous  payment.  Related  to  the  Certify  function,  “accessible”  means  the  ability  to 
certify  the  payment  in  CAPS(W). 

3.  The  Citibank  profile  allows  technicians  to  enter  information  related  to  credit  card  accounts. 

4.  “Inquiry”  means  that  the  function  can  only  be  inquired. 

Access  Profiles.  Despite  the  efforts  taken  by  DFAS  Kansas  City  to  segregate  aeeess 
within  CAPS(W),  duties  were  still  not  properly  segregated.  In  addition,  the  ability 
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to  delete  data  in  CAPS(W)  was  not  adequately  eontrolled  and  the  miseellaneous 
payment  funetion  was  not  restrieted  to  nonreeurring  payments.  The  Direetor, 
Commereial  Pay  Serviees,  should  establish  standard  aeeess  profiles  for  use 
throughout  the  CAPS(W)  network.  As  diseussed  in  finding  C,  the  aeeess  profiles 
should  eomplement  the  business  strueture  developed  for  vendor  payment  offiees.  In 
the  interim,  improved  eontrols  over  system  aeeess  are  essential  to  reduee  the  risk 
that  the  data  in  CAPS(W)  are  manipulated  to  eireumvent  PPA  requirements  or  to 
make  fraudulent  payments. 

System  and  FSD  Support.  Two  individuals  within  the  systems  offiee  at 
DFAS  Kansas  City  had  unrestrieted  system  aeeess  and  18  FSD  personnel  were 
inappropriately  granted  the  ability  to  add,  update,  and  delete  operational  data  within 
the  database.  After  we  diseussed  our  eoneerns  about  the  aeeess  granted  to  systems 
management  personnel,  DFAS  Kansas  City  deleted  the  “All”  profile  and  ereated  a 
new  “Systems  Admin”  profile.  The  new  profile  removed  the  ability  to  eertify 
payments  but  eontinued  to  allow  them  to  add,  update,  and  delete  operational  data 
sueh  as  purehase  order  information,  invoiees,  and  reeeiving  reports.  The  “FSD 
Support”  profile  granted  18  FSD  personnel  at  DFAS  Indianapolis  with  the  ability  to 
update  operational  data  within  CAPS(W).  Systems  management  personnel  stated 
that  the  aeeess  granted  the  “Systems  Admin”  and  “FSD  Support”  profiles  was 
needed  to  assist  teehnieians  with  troubleshooting  problems  in  CAPS(W).  However, 
they  eould  not  justify  why  these  eapabilities  were  required  on  a  eontinuous  basis. 

We  believe  that  systems  management  personnel  should  not  have  uneontrolled  update 
aeeess  to  the  operational  database  for  indefinite  periods  of  time.  If  they  require 
aeeess  to  troubleshoot  an  operational  problem,  systems  management  personnel 
should  perform  these  aetions  in  a  test  database  or  they  should  only  be  given  aeeess 
for  the  period  of  time  needed  to  eorreet  the  problem. 

Proper  Access  Documentation.  The  18  FSD  personnel  were  granted  aeeess 
to  CAPS(W)  without  eompleting  DISA  (Defense  Information  Seeurity  Ageney) 

Form  41,  “System  Authorization  Aeeess  Request,”  and  reeeiving  the  approval  of  the 
on-site  database  administrator  and  funetional  manager  at  DFAS  Kansas  City.  Eaeh 
DISA  Form  41  should  speeify  the  level  of  aeeess  granted  and  indieate  that  systems 
managers  approved  the  aeeess.  A  DISA  Form  41  was  not  on  file  at  DFAS  Kansas 
City  for  any  of  the  18  FSD  personnel. 

Vendor  Maintenance.  DFAS  Kansas  City  granted  too  many  users  the  ability 
to  update  vendor  maintenanee  tables  and  provided  those  with  this  aeeess  the  ability  to 
update  other  vendor  payment  information.  Only  a  limited  number  of  individuals 
should  be  allowed  to  update  the  vendor  maintenanee  tables  eontaining  Eleetronie 
Funds  Transfer  (EFT)  and  eheek  remittanee  information.  However,  these 
individuals  should  not  be  able  to  alter  any  of  the  other  payment  data  or  eertify  the 
payment.  The  nine  individuals  with  the  “All,”  “Contraet  Input,”  and  “Support 
Team  Leader”  profiles  eould  update  the  vendor  maintenanee  tables.  They  eould  also 
add,  update,  or  delete  purehase  order  data.  The  two  individuals  in  the  “All”  profile 
eould  also  add,  update,  and  delete  invoiee  and  reeeipt  data  and  eertify  a  payment. 

The  ability  to  update  vendor  maintenanee  tables  should  be  limited.  For  example,  the 
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vendor  payment  offiees  that  used  the  Integrated  Aeeounts  Payable  System 
limited  aeeess  to  no  more  than  three  people,  and  these  people  did  not  have  the 
ability  to  update  any  other  type  of  vendor  payment  information. 

Deletion  of  Records.  The  ability  to  delete  data  in  CAPS(W)  was  not 
adequately  eontr oiled.  Individuals  with  the  funetional  eapability  to  add,  inquire, 
and  update  invoiees  and  reeeiving  reports;  perform  purehase  order  maintenanee; 
and  maintain  vendor  information  eould  also  delete  that  information  from 
CAPS(W).  The  ability  to  delete  data  was  not  separated  from  the  ability  to  add, 
inquire,  and  update  data  in  the  profiles  established  by  DFAS  Kansas  City.  Only 
a  limited  number  of  individuals  should  have  the  ability  to  delete  data  from 
CAPS(W).  This  ability  should  be  restrieted  to  either  the  supervisors  of  the 
aeeounts  payable  seetion  or  the  senior  staff  aeeountant  in  the  vendor  payment 
offiee.  Further,  a  proper  audit  trail  should  be  developed  and  maintained  of  all 
data  removed  from  the  system.  For  example,  DFAS  St.  Louis,  St.  Louis, 
Missouri,  had  limited  the  ability  to  delete  reeords  to  only  the  staff  aeeountants 
working  within  the  vendor  payment  offiee.  Before  data  were  removed  from 
CAPS(W),  a  teehnieian  provided  a  staff  aeeountant  with  doeumentation 
explaining  why  the  data  required  removal.  The  doeumentation  was  maintained 
and  eompared  to  the  CAPS(W)  report,  “Deleted  Reeords  Report,”  to  validate 
that  data  were  removed  properly.  The  ability  to  delete  data  from  CAPS(W) 
should  be  better  eontrolled  in  order  to  limit  Ae  risk  that  interest  penalties  are 
avoided  by  removing  old  doeuments  from  the  system  and  ealeulating  new 
payment  due  dates. 

Miscellaneous  Payments.  DFAS  Kansas  City  should  limit  the  number 
of  individuals  granted  the  miseellaneous  payments  funetion  and  restriet  the  use 
of  the  funetion  to  only  speeifie  types  of  miseellaneous  payments.  DFAS  Kansas 
City  granted  45  individuals  with  the  ability  to  enter  all  the  data  (invoiee,  reeeipt, 
obligation,  and  vendor  remittanee  data)  for  entitling  a  miseellaneous  payment. 
The  funetion  was  ereated  to  expedite  the  entry  of  data  for  making  miseellaneous 
payments.  Twenty  of  the  45  individuals  were  systems  management  personnel 
who  had  been  assigned  the  “FSD  Support”  and  “All”  aeeess  profiles.  Twenty 
voueher  examiners  also  had  this  funetional  eapability.  As  previously  diseussed, 
systems  management  personnel  should  not  routinely  have  the  ability  to  proeess 
the  information  neeessary  to  make  vendor  payments.  Beeause  of  the  extensive 
eapability  granted  the  miseellaneous  payments  funetion,  no  more  than  five 
individuals  assigned  the  “Examiner  1”  aeeess  profile  should  be  granted  this 
funetion.  Most  of  the  30  different  types  of  miseellaneous  payments  that  DFAS 
Kansas  City  made  were  less  than  $2,500  and  were  often  not  individually 
reviewed  and  eertified  before  they  were  made.  The  use  of  the  miseellaneous 
payments  funetion  should  usually  be  limited  to  one-time  payments,  sueh  as  legal 
elaims.  Reeurring  payments,  sueh  as  utility  payments,  should  be  established  in 
CAPS(W)  as  eontraet  payments  so  that  more  than  one  individual  would  be 
responsible  for  entering  the  data  for  entitling  the  payments. 
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Remote  Access 


Allowing  personnel  at  Marine  Corps  installations  to  remotely  enter  and  eertify 
payment  data  was  risky  beeause  CAPS(W)  did  not  limit  aeeess  within  the 
database.  CAPS(W)  did  not  prevent  system  users  at  Marine  Corps  installations 
from  updating  data  and  eertifying  payments  of  other  installations.  In  addition, 
DFAS  Kansas  City  had  not  established  appropriate  eompensating  eontrols  to 
ensure  the  integrity  of  the  remotely  entered  data. 

Segregating  Duties  of  Remote  Users.  CAPS(W)  did  not  restriet  aeeess 
within  a  database.  An  individual  given  the  ability  to  add,  update,  or  delete 
information  eould  alter  entitlement  information  for  any  organization  in  the 
database.  A  eertifieation  offieial  eould  eertify  any  payment  in  the  database.  For 
example,  the  two  individuals  in  the  systems  offiee  at  DFAS  Kansas  City  eould 
enter,  update,  and  delete  payment  data  and  eertify  all  payments  in  the  database. 
Consequently,  the  data  entered  by  the  13  Marine  Corps  installations  were  not 
seeure  and  eould  be  altered  by  anyone  with  similar  aeeess.  The  installations 
attempted  to  segregate  duties  by  requiring  that  different  individuals  enter  the 
data  and  eertify  the  payment.  Speeifieally: 

•  25  individuals  eould  enter,  update,  and  delete  invoiees,  reeeiving 
reports,  purehase  order  data,  and  vendor  remittanee  information. 
These  25  individuals  eould  update  or  delete  any  information  in  the 
database. 

•  19  individuals  eould  eertify  payments.  Although  DFAS  Kansas  City 
had  signature  eards  and  appointment  letters  on  file  for  eaeh  of  these 
individuals,  CAPS(W)  allowed  eertifieation  offieials  to  eertify  any 
payment  in  the  database. 

A  system  ehange  to  CAPS(W)  had  been  requested  in  February  1998  that 
would  have  restrieted  the  ability  of  remote  users  to  aeeess  only  the  information 
related  to  their  organization.  However,  the  system  ehange  was  not  made 
beeause  of  its  eost  and  the  antieipated  fielding  of  DPPS.  DFAS  plans  to  field 
DPPS  at  DFAS  Kansas  City  in  Deeember  2001.  However,  the  date  slipped  and 
a  revised  date  had  not  been  set.  Unless  eompensating  eontrols  are  in  plaee  to 
ensure  that  unauthorized  ehanges  to  payment  information  are  prevented  or 
immediately  identified  and  eorreeted,  people  outside  the  paying  offiee  should 
not  have  the  ability  to  ehange  the  information  in  CAPS(W).  The  aeeess  granted 
the  2  individuals  in  the  systems  offiee  at  DFAS  Kansas  City  should  be  removed, 
and  the  aeeess  of  the  25  individuals  should  be  segregated.  One  individual 
should  not  be  able  to  enter,  update,  and  delete  invoiees  and  reeeiving  reports; 
perform  purehase  order  maintenanee;  and  maintain  vendor  remittanee 
information. 

Compensating  Controls.  DFAS  Kansas  City  had  not  established  a 
memorandum  of  understanding  with  eaeh  of  the  13  Marine  Corps  installations 
that  identified  the  speeifie  types  of  payments  that  eould  have  been  proeessed  in 
the  database,  requirements  for  properly  supporting  payments,  and  proeedures 
for  retaining  doeuments  supporting  payments.  Although  DFAS  Kansas  City  had 
the  ability  to  delete  any  transaetion  from  the  upload  to  the  disbursing  system. 
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DFAS  Kansas  City  had  not  established  other  eompensating  eontrols  to  ensure 
that  individuals  were  not  inappropriately  altering  data  within  the  database  and 
that  the  payments  were  proper.  DFAS  Kansas  City  was  not  monitoring  the 
system  to  ensure  that  only  appropriately  authorized  individuals  were  entering, 
altering,  and  deleting  information  supporting  payments  and  eertifying  payments. 
At  a  minimum,  an  audit  trail  should  be  established  and  periodieally  reviewed  to 
deteet  ehanges  to  entitlement  data.  DFAS  Kansas  City  should  also  periodieally 
perform  a  detailed  review  of  the  types  of  payments  that  are  entered  remotely  and 
the  support  for  them.  Remote  aeeess  to  update  and  eertify  information  in 
CAPS(W)  should  be  removed  until  sueh  time  as  CAPS(W)  ean  be  ehanged, 
replaeed,  or  adequate  eompensating  eontrols  developed  and  implemented. 

CAPS(W)  System  Concerns 


DFAS  Kansas  City  reported  as  a  material  weakness  in  its  FY  2000  Annual 
Statement  of  Assuranee,  dated  Oetober  25,  2000,  that  aeeess  eontrols  within 
CAPS(W)  were  inadequate.  Speeifieally,  the  FY  2000  Annual  Statement  of 
Assuranee  reported  that: 

•  individuals  assigned  to  DFAS  Kansas  City  systems  management 
offiee  had  a  global  (“All”)  aeeess  that  allowed  them  to  perform 
funetions  that  eould  result  in  fraudulent  payments  that  would  be 
diffieult  or  impossible  to  deteet, 

•  DFAS  Kansas  City  systems  management  offiee  personnel  eould 
self-assign  and  modify  aeeess  eapabilities,  and 

•  FSD  personnel  at  DFAS  Indianapolis  eould  manipulate  databases 
without  proper  audit  trails  and  eontrol  by  the  DFAS  Kansas  City 
systems  management  offiee. 

DFAS  Kansas  City  eoneluded  that  beeause  it  did  not  have  eontrol  of  CAPS(W), 
the  problems  needed  to  be  resolved  by  DFAS  Arlington.*  We  agree  that  system 
ehanges  were  outside  the  eontrol  of  DFAS  Kansas  City.  However,  DFAS 
Kansas  City  eould  have  eliminated  the  aeeess  granted  by  the  “All”  profile  and 
developed  eompensating  eontrols  to  monitor  the  ehanges  made  by  systems 
management  personnel. 

Summary 


DFAS  Kansas  City  did  not  suffieiently  segregate  aeeess  within  CAPS(W)  and 
limit  the  number  of  users  who  eould  update  the  vendor  maintenanee  tables,  enter 
miseellaneous  payments,  and  delete  information  in  CAPS(W).  Systems 
management  personnel  should  not  have  universal  system  aeeess.  Users  granted 
aeeess  to  CAPS(W)  should  properly  eomplete  aeeess  forms  to  inelude  approvals 
by  the  funetional  manager  and  database  administrator.  Standard  user  profiles 
for  CAPS(W)  should  be  developed  that  fully  eonsider  the  need  to  standardize  the 


*DFAS  Arlington  is  the  site  of  DFAS  headquarters. 
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structure  of  the  vendor  payment  offiee  and  business  praetiees  within  DFAS  for 
making  vendor  payments.  Although  DFAS  Kansas  City  identified  system  aeeess 
issues  as  a  material  management  eontrol  weakness  in  its  FY  2000  Annual 
Statement  of  Assuranee,  it  had  not  taken  suffieient  aetions  to  eorreet  the 
problems  and  identified  the  full  seope  of  system  weaknesses  that  eould  result  in 
unauthorized  CAPS(W)  aeeess  and  the  manipulation  of  eertified  payment  data. 

Recommendations,  Management  Comments,  and  Audit 
Response 

A.  We  recommend  that  the  Director,  Commercial  Pay  Services,  establish 
compensating  controls  at  the  Defense  Finance  and  Acconnting  Service 
Kansas  City  that  will: 

1.  Restrict  the  access  granted  nnder  the  “Financial  Systems 
Directorate  Snpport”  and  “System  Admin”  profiles  to  system  related 
fnnctions  for  specific  periods  of  time. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  DFAS  would  review  system  access  profiles  to  ensure  that  they 
provide  adequate  separation  of  duties. 

2.  Ensure  a  Defense  Information  Security  Agency  Form  41,  “System 
Authorization  Access  Request,”  is  properly  completed  and  on  file  before 
granting  access  to  the  Computerized  Accounts  Payable  System  for 
Windows. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  a  properly  completed  DISA  Form  41  on  file  before  granting  access  to 
CAPS(W). 


3.  Limit  access  to  update  vendor  maintenance  tables  and  eliminate 
other  types  of  update  access  granted  to  individuals  with  vendor  maintenance 
access. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  DFAS  will  review  system  access  profiles  to  ensure  that  they  provide 
adequate  separation  of  duties. 

4.  Limit  the  ability  to  delete  data  from  the  Computerized  Accounts 
Payable  System  for  Windows  and  establish  audit  trails  for  data  removed 
from  the  system. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  DFAS  will  review  system  access  profiles  to  ensure  that  they  provide 
adequate  separation  of  duties. 

5.  Limit  the  use  of  the  miscellaneous  payments  function  to 
nonrecurring  payments. 
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DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  DFAS  will  review  system  access  profiles  to  ensure  that  they  provide 
adequate  separation  of  duties. 

6.  Remove  remote  access  to  update  and  certify  information  in  the 
Computerized  Accounts  Payable  System  for  Windows  until  the  system  can 
provide  proper  segregation  of  duties  and  security  over  remotely  entered 
data. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  nonconcurred  and 
stated  that  a  separate  CAPS(W)  database  was  used  to  manage  Marine  Corps 
utility  payments.  The  Director  also  stated  that  DFAS  will  work  with  the  Marine 
Corps  to  ensure  that  certification  officials  only  certify  payments  belonging  to  the 
certifying  official’s  organization. 

Audit  Response.  The  DFAS  comments  were  partially  responsive.  While  the 
ability  to  update  and  certify  information  was  somewhat  restricted  by  using  a 
separate  database,  individuals  working  in  organizations  at  the  13  sites  had  access 
to  the  database  and  could  alter  payment  information  that  did  not  belong  to  their 
organization.  Until  CAPS(W)  can  provide  security  over  remotely  entered  data, 
remote  access  should  be  removed.  We  request  that  DFAS  reconsider  its 
position  on  the  recommendation  and  provide  comments  on  the  final  report. 
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B.  Documentation  Supporting  Vendor 
Payments 

DFAS  Kansas  City  made  17,983  payments  from  May  1  through  July  31, 
2000,  and  approximately  16,605  of  these  payments  laeked  at  least  one 
element  of  support  preseribed  in  5  Code  of  Federal  Regulations  (C.F.R.) 
Part  1315.  Both  eontraet  and  miseellaneous  payments  laeked  the 
required  doeumentation.  The  faet  that  a  payment  was  not  supported  did 
not  mean  that  the  payment  was  invalid  or  fraudulent,  but  indieated 
management’s  failure  to  enforee  the  requirements  neeessary  for  proper 
support.  Payments  were  made  without  the  proper  support  beeause; 

•  DoD  Regulation  7000. 14-R,  volume  10,  allowed  exeeptions  to 
requirements  for  a  proper  invoiee  and  did  not  speeify  what  a 
reeeiving  report  must  eontain  to  properly  support  a  payment; 

•  DoD  guidanee  in  the  Federal  Aequisition  Regulation  (FAR)  and 
the  DoD  Regulation  7000. 14-R,  volume  10,  is  ineonsistent  with 
and  has  not  been  revised  to  eomply  with  5  C.F.R.  Part  1315; 

•  standardized  rules  for  making  properly  supported  miseellaneous 
payments  did  not  exist;  and 

•  DFAS  Kansas  City  teehnieians  and  eertifieation  offieials  either 
did  not  deteet  missing  and  ineomplete  items  on  supporting 
doeuments  or  eonsidered  the  items  unneeessary  for  making  the 
payments. 

As  a  result,  DFAS  and  Marine  Corps  managers  ineurred  an  inereased 
risk  that  payments  were  not  being  made  in  eomplianee  with  the  Prompt 
Payment  Aet  (PPA)  and  that  improper  payments  may  have  been  made. 

Review  of  Vendor  Payments 


Criteria.  The  prineipal  guidanee  used  for  making  payment  to  vendors  was  the 
PPA,  as  implemented  by  the  Offiee  of  Management  and  Budget  (0MB)  in 
5  C.F.R.  Part  1315,  “Prompt  Payment;  Final  Rule,”  September  29,  1999.  The 
0MB  guidanee  has  striet  requirements  that  supporting  doeuments  must  meet  in 
order  to  be  eonsidered  proper.  The  PPA  and  supporting  doeumentation 
requirements  are  further  deseribed  in  FAR  subpart  32.9,  “Prompt  Payment;” 
Defense  Federal  Aequisition  Regulation  Supplement  (DFARS)  subpart  232.9, 
“Prompt  Payment;”  and  DoD  Regulation  7000. 14-R,  volume  10,  “Contraet 
Payment  Poliey  and  Proeedures,”  November  1999.  The  FAR  subpart  32.9, 
DFARS  subpart  232.9,  and  DoD  Regulation  7000. 14-R,  volume  10,  are  in  the 
proeess  of  being  updated.  DFAS  Kansas  City  made  payments  based  on  eontraet 
doeuments  that  needed  to  eomply  with  the  prompt  payment  eriteria  and 
miseellaneous  payments  that  had  limited  business  rules  on  how  eaeh  payment 
should  be  supported.  DoD  Regulation  7000. 14-R,  volume  10,  also  eontains 
some  information  on  how  to  support  many  of  the  miseellaneous  payments  made 


12 


by  DoD.  DFAS  Kansas  City  further  defined  the  requirements  for  supporting 
doeuments  within  a  loeally  developed  standard  operating  proeedure.  DFAS 
Kansas  City  revised  its  Vendor  Pay  Standard  Operating  Proeedures  in 
Oetober  2000.  Guidanee  on  supporting  doeumentation  is  diseussed  in 
Appendix  D. 

Sample  Selection.  To  determine  whether  the  doeuments  that  were  used  to 
support  CAPS(W)  payments  eomplied  with  5  C.F.R.  Part  1315  requirements, 
we  obtained  a  population  of  17,983  payments,  valued  at  $290.6  million,  made 
using  CAPS(W)  from  May  1  through  July  31,  2000.  From  this  population,  we 
seleeted  a  sample  of  208  payments  in  3  strata.  We  used  the  eriteria  in  the 
5  C.F.R.  Part  1315  to  assess  the  doeuments  (invoiee,  reeeiving  report,  and 
obligation  doeument)  that  supported  eaeh  sample  item.  The  sample  also 
determined  whether  the  data  on  the  supporting  doeuments  were  entered  eorreetly 
in  CAPS(W).  Details  eoneerning  sample  seleetion  are  eontained  in  Appendix  C. 

Sample  Results 


Approximately  16,605  of  the  17,983  payments  made  from  May  1  through 
July  31,  2000,  were  not  supported  in  eomplianee  with  5  C.F.R.  Part  1315 
requirements.  Of  the  208  sample  items  reviewed,  101  items  were  eontraetual 
payments  and  107  items  were  miseellaneous  payments.  Table  2  shows  the 
projeetions  of  the  estimated  number  of  payments  that  were  not  properly 
supported  for  eaeh  type  of  payment.  Appendix  C  gives  details  of  projeetions 
and  eonfidenee  levels. 


Table  2.  Estimated  Payments  Not  Properly  Supported 
by  Type  of  Payment 

Type  of  Payment 

Total  Payments 

Estimate  of  Improperly 
Supported  Payments 

Contraetual 

8,175 

7,511 

Miseellaneous 

9,808 

9,094 

Total 

17,983 

16,605 

Doeuments  supporting  eontraet  payments  must  meet  the  5  C.F.R.  Part  1315 
requirements  to  be  eonsidered  proper.  We  held  supporting  doeumentation  for 
miseellaneous  payments  to  very  similar  standards.  Although  a  ease  ean  be  made 
for  not  holding  miseellaneous  payments  to  these  striet  standards,  standard 
business  rules  outlining  the  requirements  for  supporting  doeumentation  for 
miseellaneous  payment  was  limited.  A  determination  tiiat  a  payment  was  not 
properly  supported  did  not  mean  that  the  payment  was  invalid  or  fraudulent. 
Instead,  it  showed  that  DFAS  Kansas  City  had  not  strietly  enforeed  the  5  C.F.R. 
Part  1315  requirements  for  supporting  doeuments,  ereating  an  environment 
where  improper  and  fraudulent  payments  eould  be  made  without  deteetion.  Our 
sample  also  showed  that  37  payments  were  eonsidered  improper  beeause  the 
vendor  was  paid  the  ineorreet  amount  or  the  payment  should  not  have  been 
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made  based  on  the  supporting  doeumentation  provided.  When  projeeted  aeross 
the  population,  this  would  result  in  between  2,045  and  4,680  improper 
payments. 


Contractual  Payments 


Determination  of  Proper  Payments.  The  results  of  the  sample  showed  that 
DFAS  Kansas  City  made  about  7,511  eontraet  payments  from  May  1  through 
July  31,  2000,  without  the  proper  support.  The  payments  were  made  beeause 
DFAS  Kansas  City  teehnieians  and  eertifieation  offieials  either  did  not  deteet 
missing  items  required  on  supporting  doeuments  or  eonsidered  the  items 
unneeessary  for  making  the  payments.  Doeuments  that  laeked  elements  of 
support  preseribed  in  regulations  implementing  the  PPA  were  to  be  returned  to 
the  originator  and  no  payment  made  until  a  eorreeted  eopy  of  the  doeument  was 
obtained.  If  the  doeument  did  not  meet  these  requirements,  we  eonsidered  it 
improper.  Table  3  shows  the  estimated  number  of  unsupported  payments 
eaused  by  eaeh  type  of  supporting  doeument.  Beeause  more  than  one  doeument 
eould  have  eaused  a  payment  to  b^e  unsupported,  the  total  number  of  improperly 
supported  payments  in  Table  3  exeeeds  7,511  payments.  Appendix  C  provides 
details  of  the  sample. 


Table  3.  Estimated  Number  of  Payments  Not  Properly 

Supported  by  Type  of  Document 

Improper  Doeument 

Number  of  Payments 

Invoiee 

2,916 

Reeeiving  Report 

7,315 

Contraet 

Not  Reportable 

Invoices.  The  review  of  sample  payments  showed  that  31  of 
101  invoiees  did  not  properly  support  the  payments.  Invoiees  were  improper  if 
they  did  not  eontain  a  eontraet  or  obligating  doeument  number,  did  not 
adequately  deseribe  what  was  purehased  or  the  deseription  was  ineonsistent  with 
the  eontraet,  or  were  altered.  When  our  results  were  projeeted  over  the 
population,  about  2,916  invoiees  submitted  were  not  proper  for  payment  and 
should  have  been  returned.  Appendix  C  gives  details  of  the  sample  projeetions. 
DFAS  Kansas  City  teehnieians  aeeepted  the  invoiees  even  though  they  were 
missing  information  or  the  information  on  them  was  ineomplete.  DoD 
Regulation  7000. 14-R,  volume  10,  allowed  exeeptions  to  requirements  for  a 
valid  invoiee.  The  regulation  states  that  it  is  not  neeessary  for  an  invoiee  to  be 
free  of  defeets  in  order  for  it  to  be  proper  and  ereate  a  valid  demand  on  the 
Government;  the  approving  aetivity  determines  whether  a  valid  demand  exists. 
These  exeeptions  were  eontrary  to  5  C.F.R.  Part  1315  and  FAR  requirements 
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(Appendix  D).  We  also  identified  problems  with  the  eomputation  of  invoiee 
reeeipt  dates  when  the  designated  billing  offiee  was  other  than  the  payment 
offiee. 


Contract  Numbers.  DFAS  Kansas  City  made  payments  based  on 
invoiees  that  did  not  have  eontraet  numbers  identified  on  the  original  invoiees 
submitted  by  the  vendors.  DFAS  Kansas  City  either  ereated  the  eontraet  number 
from  other  sourees  or  aeeepted  an  invoiee  that  had  the  eontraet  number  eorreeted 
by  someone  other  than  the  vendor.  The  sample  showed  that  this  eondition 
oeeurred  for  20  eontraet  payments.  For  example,  a  eontraetor  submitted  invoiee 
number  478115,  to  Marine  Corps  Air  Station,  Cherry  Point,  North  Carolina,  for 
serviees  rendered  during  FY  2000.  The  invoiee  eited  an  ineomplete  eontraet 
number.  Instead  of  returning  the  invoiee  to  the  vendor  to  ensure  the  payment 
was  made  to  the  eorreet  eontraet,  personnel  at  the  installation  eontraeting  offiee 
plaeed  the  eontraet  number  on  the  invoiee.  In  another  situation,  a  vendor 
submitted  invoiee  number  E87833  to  Marine  Corps  Detaehment,  Aberdeen 
Proving  Ground,  Maryland,  without  a  eontraet  number  on  the  invoiee.  The 
Marine  Corps  Detaehment  forwarded  the  invoiee  to  DFAS  Kansas  City  along 
with  the  reeeiving  report.  On  the  reeeiving  report,  Aberdeen  Proving  Ground 
personnel  eited  the  eorreet  eontraet  number.  Instead  of  returning  the  invoiee  to 
the  vendor  for  eorreetion,  DFAS  Kansas  City  used  the  eontraet  number  on  the 
reeeiving  report  to  overeome  the  omission  on  the  invoiee. 

Descriptions  Consistent  with  the  Contract.  Invoices  submitted 
for  payment  should  describe  the  goods  received  or  services  performed  and  be 
consistent  with  the  line  items  contained  in  the  contract.  In  16  of  the  payments 
reviewed,  the  items  billed  were  not  consistent  with  the  items  contained  in  the 
contract  or  did  not  contain  an  adequate  description  of  what  was  invoiced.  For 
example,  a  contractor  submitted  invoice  number  99-07 Y-0005 14  to  Marine  Corps 
Logistics  Base,  Barstow,  California.  The  invoice  stated  that  it  was  for  work 
done  on  an  oil  separator  in  Building  375.  The  contract  delivery  order  identified 
nine  different  line  items  for  several  types  of  labor,  material,  and  equipment,  but 
did  not  indicate  anything  about  an  oil  separator  or  Building  375.  DFAS  Kansas 
City  technicians  assumed  that  the  vendor  provided  the  services  contracted  for 
because  the  total  amount  from  the  invoice  matched  the  total  amount  on  the 
delivery  order.  The  technicians  should  have  returned  the  invoice  to  the  vendor 
and  requested  that  a  corrected  invoice  be  provided  specifying  the  line  items 
contained  in  the  contract  delivery  order.  In  another  case,  a  vendor  submitted 
invoice  number  CP0500  to  Marine  Corps  Air  Station,  Cherry  Point,  North 
Carolina,  for  reimbursement  of  dumping  fees  and  part  of  the  fixed-price  work  on 
the  contract.  The  contract  broke  out  the  fixed-price  work  into  three  specific  line 
items.  Two  of  the  line  items  were  for  monthly  services  and  one  was  for  weekly 
services.  The  invoice  did  not  state  a  period  of  time  that  it  covered.  The 
receiving  report  with  this  payment  treated  it  as  a  progress  payment  with  a 
percentage  of  work  completed  rather  than  a  service  contract.  The  description  on 
the  invoice  should  have  been  consistent  with  the  line  items  in  the  contract  and 
provided  the  period  of  performance. 

Invoice  Alteration.  DFAS  Kansas  City’s  standard  operating 
procedures  allowed  for  the  alteration  of  invoice  data  provided  the  data  was  lined 
out  so  the  original  information  could  be  read  and  initialed  by  the  person  making 
the  correction.  According  to  5  C.F.R.  Part  1315,  an  invoice  that  is  missing 
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required  data  should  be  returned  to  the  vendor,  whieh  ean  make  the  needed 
eorreetions  and  resubmit  a  elearly  marked  eorreeted  invoiee.  Nine  invoiees 
reviewed  in  our  sample  were  altered  to  make  the  information  needed  for  payment 
proper.  None  of  the  altered  invoiees  were  identified  as  eorreeted  invoiees. 

When  we  questioned  teehnieians  as  to  who  made  the  eorreetions,  teehnieians 
eould  not  identify  the  person  making  the  ehanges.  When  we  eontaeted 
individuals  in  the  designated  billing  offiees  at  Marine  Corps  installations,  they 
stated  that  they  usually  eorreeted  the  invoiees.  Beeause  improper  invoiees  were 
not  returned  to  the  vendors  for  eorreetion,  future  invoiees  on  the  eontraet  eould 
eontain  identieal  errors.  DFAS  should  not  aeeept  for  payment  any  invoiee  that 
was  altered  by  anyone  other  than  the  originator  of  the  invoiee. 

Invoices  Sent  to  Other  Than  the  Payment  Office.  When 
invoiees  were  sent  to  other  than  the  payment  offiee,  the  invoiee  reeeipt  dates 
were  often  not  used  properly  to  eompute  the  payment  due  date  and  the  payment 
proeess  was  delayed. 


Invoice  Receipt  Dates.  DFAS  Kansas  City  did  not  use  the 
eorreet  invoiee  reeeipt  dates  when  the  date  stamp  did  not  elearly  identify  the 
designated  billing  offiee.  In  the  sample,  51  of  101  invoiees  reviewed  did  not 
have  invoiee  reeeipt  dates  affixed  to  the  invoiees  that  elearly  identified  that  the 
designated  billing  offiee  had  affixed  the  date  to  the  invoiee.  To  properly 
eompute  payment  due  dates,  the  teehnieian  must  enter  into  CAPS(W)  the  date  the 
invoiee  was  reeeived  in  the  designated  billing  offiee.  The  payment  offiee  ean 
only  use  the  designated  billing  offiee ’s  date  stamp  when  determining  the  invoiee 
reeeipt.  If  it  ean  not  be  elearly  determined  that  the  date  stamp  was  affixed  to  the 
invoiee  by  the  designated  billing  offiee,  the  payment  offiee  is  required  by 
5  C.F.R.  Part  1315  to  use  the  date  plaeed  on  the  invoiee  by  the  vendor.  Invoiees 
that  were  sent  direetly  to  DFAS  Kansas  City  were  usually  properly  date-stamped. 
However,  when  an  invoiee  was  sent  to  an  aetivity  other  than  DFAS  Kansas  City, 
it  was  often  diffieult  to  determine  whether  the  date  stamp  was  affixed  to  the 
invoiee  by  the  billing  offiee  designated  in  the  eontraet  or  by  another  installation 
aetivity.  The  date  stamp  was  often  just  a  date  affixed  to  the  invoiee  without  any 
designation  as  to  whieh  offiee  the  stamp  belonged.  In  these  instanees,  DFAS 
Kansas  City  should  have  used  the  date  of  invoiee  in  determining  payment  dates. 

Invoices  Sent  to  Installations.  Many  invoices  submitted 
for  payment  were  improperly  sent  to  a  Marine  Corps  activity  rather  than  directly 
to  the  DFAS  Kansas  City  payment  office.  Contracting  officers  should  require 
that  vendors  send  invoices  to  a  base-level  activity  only  when  a  requirement  exists 
for  that  activity  to  certify  what  was  being  billed  (such  as  construction  payments). 
In  all  other  cases,  the  contracting  officer  should  require  that  the  invoices  be  sent 
directly  to  DFAS  Kansas  City.  Sending  invoices  to  installations  created  an 
unnecessary  requirement  that  slowed  the  payment  process,  increased  lost 
discounts,  and  increased  the  probability  that  interest  would  be  due  the  vendor. 

Improvements  Required  to  Invoice  Processing.  To  improve 
internal  controls  over  the  processing  of  invoices,  DFAS  must  establish  business 
rules  that  require  invoices  to  comply  with  5  C.F.R.  Part  1315  requirements. 
Invoices  that  do  not  meet  all  requirements  of  a  proper  invoice  should  be  returned 
within  7  days  to  the  vendor  with  a  request  that  a  corrected  invoice  be  submitted. 
Marine  Corps  contracting  officers  should  ensure  that  contracts  clearly  identify 


16 


that  each  invoice  must  include  a  contract  number,  invoice  number  and  date,  and 
a  clear  description  of  the  goods  or  services  provided  by  the  vendor.  They  should 
also  reduce  the  number  of  invoices  being  sent  to  designated  billing  offices  other 
than  DFAS  Kansas  City.  However,  when  invoices  are  sent  to  designated  billing 
offices  outside  the  payment  office.  Marine  Corps  personnel  should  be  directed  to 
return  them  to  the  vendor  for  correction  instead  of  altering  the  invoices  to  make 
them  correct.  In  addition,  invoices  should  be  immediately  date-stamped  with  a 
stamp  that  clearly  identifies  the  designated  billing  office  or  that  identifies  the 
designated  billing  office  through  some  other  means. 

Receiving  Reports.  The  review  of  sample  payments  showed  that 
86  receiving  reports  did  not  properly  support  the  payments.  When  projected  to 
the  entire  population,  about  7,315  receiving  reports  did  not  meet  the  5  C.F.R. 
Part  1315  requirements  for  a  proper  receiving  report  and  should  have  been 
returned.  Appendix  C  contains  details  on  sample  projections.  A  payment  was 
assessed  as  not  properly  supported  if  the  receiving  report  did  not  identify  receipt 
and  acceptance  dates;  provide  a  description  of  the  goods  received  or  services 
performed;  and  provide  a  proper  signature,  printed  name,  address,  and  telephone 
number  of  the  receiving  or  accepting  official.  Most  receiving  reports  in  the 
sample  were  missing  the  dates  of  receipt  and  acceptance  and  required  signature 
information.  Payments  were  often  supported  by  a  NAVCOMPT  Form  2277, 
“Voucher  for  Disbursement  and/or  Collection,”  certified  invoices,  or  locally 
developed  forms  which  did  not  meet  5  C.F.R.  Part  1315  requirements  for  proper 
receiving  reports.  DFAS  Kansas  City  and  the  Marine  Corps  did  not  establish  or 
enforce  clear  requirements  on  the  elements  required  for  documenting  proper 
receipt  and  acceptance  of  goods  and  services.  In  addition,  DoD 
Regulation  7000. 14-R,  volume  10,  did  not  specify  what  a  receiving  report  must 
contain  to  properly  support  a  payment.  The  items  required  for  a  proper 
receiving  report  are  contained  in  Appendix  D. 

Receipt  and  Acceptance.  DFAS  Kansas  City  made  payments  to 
vendors  without  documentation  showing  the  actual  date  of  receipt  and  acceptance 
of  the  goods  and  services.  Receipt  and  acceptance  of  goods  and  services  are  two 
separate  acts  accomplished  at  the  installation  level  to  ensure  that  items  and 
services  contracted  for  are  received  and  properly  accepted.  The  sample  showed 
that  31  of  101  payments  were  made  without  receipt  and  acceptance  dates. 
Payments  were  often  supported  by  NAVCOMPT  Form  2277.  This  form  showed 
the  date  an  official  signed  the  form  but  often  did  not  specify  when  goods  or 
services  were  received  and  accepted.  Technicians  would  improperly  use  the  date 
the  form  was  prepared  or  signed  by  installation  personnel  as  the  receipt  and 
acceptance  dates.  When  the  invoices  were  sent  to  Marine  Corps  activities  before 
being  submitted  to  the  payment  office  as  certified  invoices,  the  dates  of  receipt 
and  acceptance  were  recorded  on  the  invoice  using  an  ink  stamp.  However,  the 
dates  of  receipt  and  acceptance  were  sometimes  not  recorded. 

Validity  of  Receipt  and  Acceptance  Dates.  The  receipt  and 
acceptance  dates  recorded  on  the  forms  often  did  not  reflect  the  actual  dates  of 
receipt  and  acceptance.  We  contacted  receiving  activities  and  analyzed  invoice 
and  contract  data  for  most  sample  items  and  found  that  22  of  101  payments  were 
based  on  dates  on  receiving  reports  that  did  not  reflect  the  actual  date  of 
acceptance.  The  dates  on  the  receiving  reports  usually  represented  the  date  on 
which  the  receiver  completed  the  document,  not  the  actual  date  that  the  receiver 
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accepted  the  goods  or  serviees.  For  example,  invoiee  number  2000-CHR5053 
was  reeeived  at  DFAS  Kansas  City  as  a  eertified  invoiee  on  June  15,  2000.  The 
invoiee  and  the  eontraet  stated  that  the  serviees  were  ineurred  on  February  16, 
2000.  The  invoiee  date  was  Mareh  14,  2000.  However,  the  reeeiver  reeorded 
June  13,  2000,  as  the  invoiee  reeeipt  date,  the  aeeeptanee  date,  the  date  the 
invoiee  was  eertified,  and  the  date  the  invoiee  was  sent  to  disbursing.  The 
reeeiver  told  us  that  June  13,  2000,  was  the  date  that  he  had  signed  the  invoiee 
and  the  aetual  serviees  had  oeeurred  earlier.  The  use  of  dates  that  do  not  re  fleet 
the  aetual  dates  of  reeeipt  and  aeeeptanee  results  in  the  eomputation  of  ineorreet 
payment  due  dates. 

Description  of  Goods  and  Services  Received.  The  review  of 
sample  payments  showed  that  42  of  101  reeeiving  reports  reviewed  either  did  not 
properly  deseribe  the  goods  and  serviees  reeeived  or  identified  goods  or  serviees 
that  were  ineonsistent  with  the  items  eontained  in  the  eontraet.  For  example,  a 
reeeiving  report  was  sent  in  by  Aberdeen  Proving  Ground  that  listed  a  reeeipt  for 
“one  pager  serviee”  for  $78.23.  However,  the  invoiee  and  the  eontraet  were  for 
“serviee  for  four  pagers”  for  a  total  of  $78.23.  In  another  instanee,  the  supply 
direetorate  at  Marine  Corps  Air  Station,  Cherry  Point,  sent  in  a  reeeiving  report 
on  a  loeally  developed  form.  The  form  had  two  separate  areas  where  a  toief 
deseription  of  the  goods  or  serviees  should  have  been  listed.  However,  no 
information  was  entered  in  either  area.  Sinee  Marine  Corps  Air  Station,  Cherry 
Point,  listed  the  invoiee  number  on  the  form  and  sent  it  in  with  the  invoiee, 

DFAS  Kansas  City  assumed  that  the  goods  listed  on  the  invoiee  were  aetually 
reeeived.  Eaeh  reeeiving  report  is  required  to  stand  on  its  own  and  should 
deseribe  what  the  aetivity  aetually  reeeived. 

Required  Signature  Information.  The  review  of  sample 
payments  showed  that  68  of  101  reeeiving  reports  did  not  eontain  all  the  required 
signature  information.  Teehnieians  often  overlooked  the  requirement  that 
reeeiving  reports  eontain  a  signature,  printed  name,  mailing  address,  and 
telephone  number  of  the  reeeiving  or  aeeepting  offieial  on  eaeh  reeeiving  report, 
and  made  payments  without  them.  Ineomplete  information  regarding  the  address 
or  telephone  number  make  it  diffieult  for  payment  and  eontraeting  offieials  to 
subsequently  verify  aeeeptanee  in  event  of  a  dispute  or  other  issue  eoneerning  the 
eonditions  of  the  goods  reeeived  or  serviees  performed.  By  not  enforeing  the 
requirement  for  required  signature  information,  DFAS  Kansas  City  ereated  an 
environment  that  eould  result  in  improper  and  fraudulent  payments  that  eould  go 
undeteeted. 


Adequacy  of  Forms.  Most  of  the  forms  used  to  indieate  reeeipt 
and  aeeeptanee  of  goods  and  serviees  were  not  designed  as  reeeiving  reports. 
Consequently,  the  forms  did  not  eontain  spaee  for  the  reeeiver  to  enter  a  name, 
address,  title,  and  telephone  number  when  reeeiving  and  aeeepting  goods  and 
serviees.  NAVCOMPT  Form  2277,  loeally  developed  forms,  and  eertified 
invoiees  were  primarily  used  as  reeeiving  reports.  These  doeuments  did  not 
eontain  all  the  information  required  by  5  C.F.R.  Part  1315  for  proper  reeeiving 
reports.  NAVCOMPT  Form  2277  was  designed  as  a  payment  voueher  and 
should  not  have  been  used  as  a  reeeiving  report.  Certified  invoiees  should  only 
be  used  in  limited  eireumstanees.  DD  Form  250,  “Material  Inspeetion  and 
Reeeiving  Report,”  should  be  the  primary  means  for  doeumenting  reeeipt  and 
aeeeptanee.  The  form,  as  revised  in  August  2000,  met  all  5  C.F.R.  Part  1315 
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requirements  for  a  proper  reeeiving  report  when  eompleted  eorreetly.  Other 
standard  forms,  sueh  as  DD  Form  1155,  “Order  for  Supplies  or  Serviees,”  may 
also  be  used  for  making  final  payments,  provided  they  eontain  all  of  the  required 
data  elements. 


Improvements  Related  to  Receiving  Reports.  DFAS  should 
establish  and  enforee  elear  requirements  on  the  elements  required  for 
doeumenting  proper  reeeipt  and  aeeeptanee  of  goods  and  serviees.  Mandating 
the  use  of  DD  Form  250  as  the  primary  means  for  doeumenting  reeeipt  and 
aeeeptanee  would  signifieantly  improve  eomplianee  with  5  C.F.R.  Part  1315 
requirements.  Guidanee  should  be  sent  to  Marine  Corps  aetivities  emphasizing 
the  requirements  for  proper  reeeiving  reports.  The  guidanee  should  also 
emphasize  that  any  reeeiving  report  that  does  not  meet  the  requirements  of  a 
proper  reeeiving  report  will  be  returned  to  the  installation.  Marine  Corps 
managers  must  ensure  that  personnel  at  reeeiving  aetivities  are  trained  on  the 
importanee  of  reeording  proper  dates  to  prevent  the  eireumvention  of  the  PPA. 

Contracts.  The  review  of  6  sample  items  showed  that  the  payment  was 
not  supported  by  a  eontraet  doeument.  The  obligation  doeuments  used  to  make 
payments  needed  to  eontain  suffieient  information  for  the  paying  offiee  to 
properly  mateh  invoiee  and  reeeipt  information  and  make  the  payment  to  the 
eorreet  vendor.  The  six  payments  were  eonsidered  improper  sinee  the 
eontraeting  doeument  eould  not  be  provided  to  us  for  review  by  the  payment 
offiee  and  were  not  eontained  in  the  Eleetronie  Data  Aeeess  system.  Other 
eontraets  were  missing  key  elements  sueh  as  payment  terms,  a  valid  Data 
Universal  Numbering  System  (DUNS)  number,  or  a  valid  Contraetor  Aetivity 
Government  Entity  (CAGE)  eode.  For  example,  eontraets  for  48  of  the  sample 
items  did  not  provide  a  valid  DUNS  number  or  CAGE  eode  that  eould  be  used  to 
ensure  that  the  proper  information  was  extraeted  from  the  Central  Contraetor 
Registry.  DFAS  had  implemented  a  proeess  for  extraeting  the  required 
information  from  the  Central  Contraetor  Registry  into  a  Corporate  EFT  database. 
Sinee  EFT  is  the  primary  means  of  payment,  eontraeting  offiees  need  to  make 
sure  that  all  eontraets  provide  a  valid  DUNS  number  or  CAGE  eode.  The  Debt 
Colleetion  Improvement  Aet  of  1996  requires  that  payments  be  made 
eleetronieally  unless  EFT  requirements  were  waived  under  31  C.F.R. 

Part  208.4. 

Support  for  Miscellaneous  Payments 


DoD  Regulation  7000. 14-R,  volume  10,  does  not  identify  standard  business  rules 
for  making  properly  supported  miseellaneous  payments  and  DFAS  Kansas  City 
had  not  identified  the  information  neeessary  to  properly  support  eaeh  of  the 
approximately  30  types  of  miseellaneous  payments.  At  a  minimum,  the  payment 
offiee  should  ensure  that  a  proper  funding  doeument  exists  that  supports  the 
vendor’s  elaim  against  the  Government  and  an  employee  at  the  installation 
aeknowledges  that  the  item  or  serviee  being  paid  for  was  reeeived  and  aeeepted. 
Although  DFAS  Kansas  City  tried  to  eontrol  miseellaneous  payments,  proeedures 
were  not  eonsistently  followed  and  did  not  ensure  that  only  proper  payments 
were  made. 
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Requirements  for  Proper  Support.  When  miscellaneous  payments  were  held  to 
5  C.F.R.  Part  1315  requirements,  the  invoices,  receiving  reports,  and  obligating 
documents  supporting  Ac  payments  were  frequently  not  proper.  The  sample 
showed  that  about  9,094  payments  were  made  from  May  1  through  July  31, 

2000,  without  sufficient  support  (see  Appendix  C).  Improperly  supported 
payments  primarily  occurred  because  receiving  reports  did  not  contain  enough 
information  to  ensure  that  the  obligating  documents  were  proper  or  the  goods  or 
services  were  actually  received  and  accepted  by  an  authorized  Government 
official.  We  recommended  in  Inspector  General,  DoD,  Report  No.  D-2000-139, 
“Controls  Over  the  Integrated  Accounts  Payable  System,”  June  5,  2000,  that  the 
Under  Secretary  of  Defense  (Comptroller)  amend  DoD  Regulation  7000. 14-R, 
volume  10,  to  standardize  the  rules  for  making  properly  supported  miscellaneous 
payments.  The  business  rules  also  need  to  identify  how  to  develop  pseudo 
contract  and  invoice  numbers;  define  what  dates  should  be  used  for  receipt  of  an 
invoice  and  receipt  and  acceptance  of  the  goods  or  services;  and  reemphasize  that 
receiving  reports  must  identify  the  name,  address,  and  phone  number  of  the 
official  accepting  or  authorizing  the  miscellaneous  payments.  The  guidance  for 
making  vendor  payments  in  DoD  Regulation  7000. 14-R,  volume  10,  had  not 
been  changed  as  of  October  3,  2001.  The  Director,  Commercial  Pay  Services, 
should  develop  procedures  for  making  properly  supported  miscellaneous 
payments  that  can  be  used  by  payment  offices  until  DoD  Regulation  7000. 14-R, 
volume  10,  is  changed. 

Pseudo  Numbers  for  Miscellaneous  Payments.  The  process  for 
establishing  pseudo  numbers  for  miscellaneous  payments  missing  an  obligating 
document  or  invoice  number  was  inconsistent  and  increased  the  risk  that 
duplicate  payments  could  be  made.  Invoices  related  to  miscellaneous  payments 
usually  did  not  contain  an  obligating  document  number  or  an  invoice  number. 
DFAS  Kansas  City  made  about  30  different  types  of  miscellaneous  payments. 
Consequently,  technicians  assigned  to  the  accounts  payable  teams  had  to  create 
pseudo  contract  and  invoice  numbers  for  entry  in  CAPS(W). 

•  For  recurring  monthly  payments,  such  as  purchase  card  and  utility 
payments,  pseudo  contract  numbers  should  have  been  developed  that 
would  have  provided  a  history  of  the  payments  made  for  goods  and 
services  acquired  during  each  fiscal  year.  Instead,  DFAS  Kansas  City 
created  a  different  pseudo  contract  number  for  each  monthly  purchase 
card  and  utility  payment.  Having  different  pseudo  contract  numbers 
for  each  monthly  payment  created  some  problems  because  DFAS 
Kansas  City  paid  current  charges  on  invoices  with  credit  balances  and 
past  due  amounts  were  not  routinely  reconciled  to  ensure  that  all 
payments  had  been  properly  recorded  and  overpayments  did  not 
occur.  If  pseudo  contract  numbers  were  standardized  by  fiscal  year, 
technicians  would  have  been  able  to  easily  determine  whether  past  due 
amounts  were  valid,  payments  were  posted  to  the  correct  account,  and 
overpayments  were  made. 

•  Our  sample  contained  five  payments  for  childcare  services. 

Technicians  used  three  different  methods  for  creating  the  pseudo 
invoice  numbers  entered  in  CAPS(W).  A  standard  method  of 
establishing  the  pseudo  contract  and  invoice  numbers  should  be  part  of 
the  business  rules  for  determining  whether  miscellaneous  payments 
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are  properly  supported.  Onee  established,  aeeounts  payable 
teehnieians  at  DFAS  Kansas  City  should  follow  the  methodology. 

Although  DFAS  Kansas  City  had  established  some  guidanee  as  to  how  to 
establish  pseudo  numbers,  standard  business  rules  had  not  been  established  for 
ereating  these  numbers.  The  establishment  of  a  separate  team  to  work  only 
miseehaneous  payments  would  help  to  ensure  that  these  payments  were  treated  in 
a  more  uniform  manner. 

Proper  Receipt  and  Acceptance.  Most  miscellaneous  payments  did  not 
provide  enough  supporting  information  to  ensure  that  the  goods  or  services  were 
actually  received  and  accepted  by  an  authorized  Government  official.  The 
review  of  sample  payments  showed  that  the  receiving  reports  supporting 
89  miscellaneous  payments  did  not  contain  the  name,  address,  and  telephone 
number  of  the  Government  official  authorizing  the  miscellaneous  payments. 
Payments  should  not  be  made  unless  the  goods  or  services  were  clearly  identified 
and  the  official’s  name,  address,  and  telephone  number  are  on  the  supporting 
documentation  or  on  a  signature  card  on  file  in  the  payment  office. 

Improper  Payments 


Our  sample  showed  that  37  of  208  payments  were  considered  improper  because 
the  vendor  was  paid  the  incorrect  amount  or  the  payment  should  not  have  been 
made  based  on  the  supporting  documentation  provided.  When  projected  across 
the  population,  this  would  result  in  between  2,045  and  4,680  improper  payments. 
We  considered  payments  to  be  improper  when  either  the  amount  paid  to  the 
contractor  was  incorrect,  the  proper  supporting  documentation  was  not  found,  or 
the  payment  was  not  paid  via  EFT  as  required  by  the  contract.  For  example, 
DFAS  Kansas  City  overpaid  13  invoices  and  underpaid  5  invoices.  The 
underpayments  often  occurred  because  DFAS  Kansas  City  miscalculated  the 
payment  dates  and  computed  interest  incorrectly.  The  payments  were  not 
actually  made  until  1  or  more  days  after  the  computed  pay  dates.  Eight  other 
payments  were  made  to  contractors  by  check  even  though  the  contractor  was 
properly  registered  in  the  Central  Contractor  Registry.  In  these  cases,  the  law 
required  the  payment  be  made  via  EFT.  In  another  case,  DFAS  Kansas  City 
improperly  used  a  DD  Form  1556,  “Request,  Authorization,  Agreement, 
Certification  of  Training  and  Reimbursement,”  to  support  a  payment  of  $147,600 
to  a  vendor  for  training.  DoD  Regulation  7000. 14-R,  volume  10,  states  that  DD 
Form  1556  should  only  be  used  to  make  payments  up  to  $25,000. 

Summary 


DFAS  Kansas  City  and  Marine  Corps  managers  need  to  address  proper  support 
for  payments  they  make  to  vendors  and  individuals.  5  C.F.R.  Part  1315  contains 
strict  requirements  for  what  constitutes  properly  supported  payments  made  under 
the  PPA.  For  prompt  payment,  invoices  received  from  vendors  should  meet  all 
requirements  of  a  proper  invoice.  Invoices  that  fail  to  meet  the  standards  need  to 
be  immediately  returned  to  the  vendor  for  correction.  Marine  Corps  activities 
should  perform  receipt  and  acceptance  actions  immediately  upon  delivery  of  any 
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product  or  service  and  submit  eompleted  paperwork  to  the  payment  offiee. 
Doeuments  used  for  reeeipt  should  eontain  all  required  information  or  be 
returned  for  eorreetion.  Only  the  originating  aetivity  should  alter  doeuments 
supporting  payments,  and  the  doeuments  should  elearly  state  that  the  eorreetion 
was  made  by  that  aetivity.  Other  aetivities  should  not  be  authorized  to  make 
eorreetions  to  payment  doeuments.  Contraeting  offiee  personnel  should  write 
eontraets  that  elearly  provide  all  data  needed  for  payment.  Contraets  should 
detail  the  items  or  serviees  being  purehased  so  invoiees  and  reeeiving  reports  ean 
be  validated.  Miseellaneous  payments  require  assuranee  that  the  items  were 
approved  for  purehase  and  reeeived  by  an  authorized  Government  offieial.  The 
Under  Seeretary  of  Defense  (Comptroller)  still  needs  to  amend  DoD 
Regulation  7000. 14-R,  volume  10,  to  diseontinue  allowing  exeeptions  to 
requirements  for  a  proper  invoiee,  speeify  what  a  reeeiving  report  must  eontain 
to  properly  support  a  payment,  and  standardize  the  rules  for  making  properly 
supported  miseellaneous  payments.  The  Direetor,  Commereial  Pay  Serviees, 
should  issue  interim  guidanee  until  DoD  Regulation  7000. 14-R,  volume  10,  is 
ehanged.  Marine  Corps  managers  must  ensure  that  personnel  at  reeeiving 
aetivities  are  trained  on  the  importanee  of  reeording  proper  dates  to  prevent  the 
eireumvention  of  the  PPA. 

Recommendations,  Management  Comments,  and  Audit 
Response 

B.l.  We  recommend  that  the  Under  Secretary  of  Defense  for  Acqnisition, 
Technology,  and  Logistics,  in  coordination  with  the  Director,  Defense 
Finance  and  Acconnting  Service,  and  the  Military  Services,  reqnire  the  nse 
of  the  DD  Form  250,  “Material  Inspection  and  Receiving  Report,”  as  the 
primary  means  for  docnmenting  receipt  and  acceptance  of  goods  and 
services. 

Under  Secretary  of  Defense  for  Acqnisition,  Technology,  and  Logistics 
Comments.  The  Director,  Defense  Proeurement,  eoneurred  and  stated  that  she 
will  request  that  the  Defense  Aequisition  Regulations  Couneil  revise  DFARS 
subpart  232.9  to  speeify  the  use  of  the  DD  Form  250  as  the  primary  means  for 
doeumenting  reeeipt  and  aeeeptanee  of  goods  and  serviees. 

DFAS  Comments.  The  Direetor,  Commereial  Pay  Serviees,  partially  eoneurred 
with  the  reeommendation  and  stated  that  her  offiee  will  require  the  use  of  DD 
Form  250  if  poliey  is  issued  by  the  Under  Seeretary  of  Defense  for  Aequisition, 
Teehnology,  and  Logisties  and  the  Under  Seeretary  of  Defense  (Comptroller). 

Audit  Response.  The  Direetor,  Defense  Proeurement,  comments  were 
responsive.  The  Direetor,  Defense  Proeurement,  did  not  inelude  an  estimated 
eompletion  date  for  eorreetive  aetion.  We  request  that  the  Direetor,  Defense 
Proeurement,  provide  us  with  an  estimate  eompletion  date  in  response  to  the  final 
report.  The  DFAS  comments  were  responsive. 

B.2.  We  recommend  that  the  Director,  Commercial  Pay  Services,  issue 
interim  guidance  until  DoD  Regulation  7000. 14-R,  volume  10,  is  changed. 
The  guidance  should  discontinue  exceptions  to  the  requirements  for  a  proper 
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invoice,  specify  what  a  receiving  report  mnst  contain  to  properly  snpport  a 
payment,  and  standardize  the  rnles  for  making  properly  snpported 
miscellaneons  payments. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  partially  concurred 
and  stated  that  DFAS  will  ensure  that  vendor  payment  personnel  are  aware  of 
what  constitutes  a  proper  invoice  and  receiving  report  and  the  required  support 
for  miscellaneous  payments.  The  Director  also  stated  that  DFAS  will  continue  to 
use  judgement  on  returning  invoices  and  receiving  reports  with  minor  flaws  that 
do  not  distract  from  the  validity  of  the  contract,  receiving  report,  and  invoice 
being  in  agreement. 

Audit  Response.  The  DFAS  comments  were  partially  responsive.  0MB 
guidance  contained  in  5  C.F.R.  Part  1315  clearly  defines  what  constitutes  a 
proper  contract,  invoice,  and  receiving  report.  DFAS  payment  offices  must 
comply  with  these  requirements  and  return  supporting  documents  that  do  not 
meet  requirements  to  the  originator  for  correction.  Further,  the  DFAS  comments 
did  not  sufficiently  address  the  need  to  develop  standard  rules  for  making 
miscellaneous  payments.  We  request  that  DFAS  reconsider  its  position  on  the 
recommendation  and  provide  comments  to  the  final  report. 

B.3.  We  recommend  that  the  Director,  Commercial  Pay  Services,  in 
conjunction  with  the  Marine  Corps: 

a.  Develop  stringent  procedures  for  accepting  invoice  receipt  dates 
affixed  outside  the  payment  office.  Procedures  should  ensure  that  the 
payment  office  can  determine  that  the  designated  payment  office 
date-stamped  the  invoice. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  DFAS  will  coordinate  with  the  Marine  Corps  to  establish  a  procedure 
for  date-stamping  invoices  and  how  DFAS  will  handle  invoices  received  from  the 
Marine  Corps  without  a  date  stamp. 

Marine  Corps  Comments.  The  Marine  Corps  did  not  provide  comments  to  the 
draft  of  this  report.  Therefore,  we  request  that  the  Marine  Corps  provide 
comments  on  the  final  report. 

b.  Return  all  invoices  to  vendors  that  do  not  meet  payment 
requirements. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  DFAS  Kansas  City  had  developed  a  procedure  to  return  all  improper 
invoices.  In  addition,  the  Marine  Corps  Liaison  Office  was  provided  with 
guidance  on  the  requirements  for  a  proper  invoice.  Any  invoice  not  meeting  the 
requirements  of  5  C.F.R.  Part  1315.9(b)  will  be  returned. 

Marine  Corps  Comments.  The  Marine  Corps  did  not  provide  comments  on  the 
draft  of  this  report.  Therefore,  we  request  that  the  Marine  Corps  provide 
comments  on  the  final  report. 
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c.  Develop  and  issue  guidance  to  Marine  Corps  activities  identifying 
the  standards  for  proper  receipt  and  acceptance  of  Government  goods  and 
services. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  partially  concurred 
with  the  recommendation  and  stated  that  DFAS  provided  the  Marine  Corps 
Liaison  Office  with  information  on  what  constitutes  a  proper  receiving  report. 
However,  the  Director  stated  that  DFAS  does  not  issue  guidance  to  Marine 
Corps  activities. 

Audit  Response.  The  DFAS  comments  were  partially  responsive.  The 
Director,  Commercial  Pay  Services,  is  responsible  for  ensuring  that  DFAS 
Kansas  City  ensures  proper  receipt  and  acceptance  of  goods  and  services  before 
making  payments.  Therefore,  DFAS  must  work  with  Marine  Corps  managers  to 
ensure  that  proper  guidance  is  issued  to  receiving  activities  on  the  standards  for 
proper  receipt  and  acceptance.  We  request  that  DFAS  reconsider  its  position  and 
provide  comments  on  the  final  report. 

Marine  Corps  Comments.  The  Marine  Corps  did  not  provide  comments  on  the 
draft  of  this  report.  Therefore,  we  request  that  the  Marine  Corps  provide 
comments  on  the  final  report. 

d.  Provide  training  to  personnel  at  receiving  activities  on  the 
importance  of  providing  payment  offices  properly  completed  receiving 
reports  within  5  days  of  acceptance  of  goods  and  services. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  partially  concurred 
with  the  recommendation  and  stated  that  DFAS  does  not  provide  training  to 
Marine  Corps  activities.  However,  the  Director  stated  that  DFAS  will  assist  the 
Marine  Corps  in  developing  and  presenting  training  on  the  importance  of 
completing  receiving  reports  accurately  and  providing  them  to  DFAS  within 
5  days  of  acceptance  of  goods  or  services. 

Audit  Response.  The  DFAS  comments  were  responsive.  DFAS  needs  to  work 
with  the  Marine  Corps  to  ensure  that  receiving  activities  provide  DFAS  with 
proper  receiving  reports  in  a  timely  manner. 

Marine  Corps  Comments.  The  Marine  Corps  did  not  provide  comments  on  the 
draft  of  this  report.  Therefore,  we  request  that  the  Marine  Corps  provide 
comments  on  the  final  report. 

B.4.  We  recommend  that  the  Deputy  Chief  of  Staff  for  Installations  and 
Logistics,  Marine  Corps,  ensure  that  all  contracting  documents  provide  the 
information  necessary  for  making  proper  payments,  including: 

a.  Specifications  that  invoices  include  a  contract  number,  invoice 
number  and  date,  and  clear  description,  by  contract  line  item,  of  what  the 
vendor  is  invoicing  for; 

b.  Directions  to  avoid  sending  invoices  directly  to  installations  unless 
the  invoices  require  certification;  and 
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c.  Accurate  Data  Universal  Numbering  System  numbers  and 
Contractor  Activity  Government  Entity  codes. 

Marine  Corps  Comments.  The  Marine  Corps  did  not  provide  comments  on  the 
draft  of  this  report.  Therefore,  we  request  that  the  Marine  Corps  provide 
comments  on  the  final  report. 
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C.  Vendor  Payment  Office  Structure  and 
Practices 

The  structure  and  business  practices  of  the  vendor  payment  office  at 
DFAS  Kansas  City  did  not  provide  efficient  and  effective  controls  over 
vendor  payments.  Despite  actions  taken  to  segregate  duties  and  improve 
accountability  over  documents,  problems  continued  to  exist  because: 

•  positive  control  over  payment  documents  had  not  been  achieved, 

•  supporting  documents  were  not  held  to  proper  standards  and 
returned  to  the  originating  activities  when  required, 

•  certification  officials  did  not  adequately  review  all  payments,  and 

•  responsive  actions  were  not  taken  to  correct  previously  identified 
problems  and  reviews  of  payment  vouchers  were  not  periodically 
performed. 

As  a  result,  DFAS  Kansas  City  did  not  ensure  that  improperly  supported 
and  erroneous  payments  would  be  detected  and  corrected  before  payment. 

Prior  Review  of  Vendor  Payment  Operations 


On  April  23,  1999,  DFAS  Arlington  reported  on  a  review  conducted  on  vendor 
payment  operations  at  DFAS  Kansas  City.  DFAS  Arlington  recommended  that 
DFAS  Kansas  City  eliminate  the  mailroom  in  the  vendor  payment  office  and 
relocate  mailroom  functions  to  the  centralized  mailroom;  track  invoices;  restrict 
the  ability  to  change  “remit  to”  information  and  update  contract  data  to  contract 
input  technicians;  and  prohibit  certification  officials  from  making  changes  to 
invoices,  receiving  reports,  contracts,  and  payment  vouchers. 

In  FY  2000,  DFAS  Kansas  City  reorganized  some  of  its  business  practices  for 
making  vendor  payments.  Technicians  in  the  administrative  assistance  section 
became  solely  responsible  for  entering  contract  and  vendor  maintenance  data  into 
CAPS(W).  DFAS  Kansas  City  also  limited  the  CAPS(W)  access  of  lead  voucher 
examiners  and  supervisors  who  certified  payments  on  each  of  the  accounts 
payable  teams. 

Office  Structure  and  Business  Practices 


DFAS  Kansas  City  failed  to  develop  efficient  and  effective  business  practices 
within  its  vendor  payment  office  that  ensured  proper  document  control  and 
segregation  of  duties.  Until  DPPS  and  related  initiatives  aimed  at  processing 
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payment  information  in  an  automated  environment  ean  be  effeetively 
implemented,  DFAS  Kansas  City  needs  to  establish  a  vendor  payment  offiee  that: 

•  reeeives  and  date  stamps,  immediately  upon  reeeipt,  ah  ineoming 
doeuments  in  a  seeure  eentralized  mailroom  outside  the  vendor 
payment  offiee; 

•  has  a  doeument  management  seetion  that  is  the  foeal  point  for  reeeipt, 
validation,  and  eontrol  of  ah  doeumentation  supporting  vendor 
payments; 

•  ensures  that  ah  payments  are  properly  eertified;  and 

•  works  effeetively  with  Marine  Corps  eustomers  to  obtain  reeeiving 
reports  for  goods  and  serviees  promptly  upon  reeeipt  and  aeeeptanee. 

Positive  Control  Over  Incoming  Docnmentation.  Although  DFAS  Kansas  City 
changed  its  doeument  eontrol  process,  it  did  not  effectively  control  documents 
supporting  vendor  payments.  DFAS  Kansas  City  had  only  limited  visibility  and 
control  over  the  documents,  even  after  the  documents  were  entered  into 
CAPS(W).  Mailroom  operations  should  be  moved  to  the  centralized  mailroom, 
and  a  document  management  section  should  be  established  to  effectively  track, 
control,  and  screen  ah  documents  supporting  payments. 

Mailroom  Operations.  The  mailroom  in  the  administrative  assistance 
section  was  unsecured  and  provided  little  positive  control  over  incoming 
documents.  Positive  control  over  incoming  documents  is  essential.  DFAS 
Kansas  City  had  a  secure  centralized  mailroom  outside  the  vendor  payment  office 
that  could  receive  and  date-stamp  ah  incoming  vendor  payment  documents.  In 
April  1999,  DFAS  Arlington  recommended  that  DFAS  Kansas  City  relocate  the 
mailroom  in  the  vendor  payment  area  to  the  centralized  mailroom  along  with 
facsimile  machines  receiving  vendor  payment  documents.  This  change  would 
have  allowed  ah  incoming  documents  to  be  received  and  date-stamped  outside  of 
the  vendor  payment  office.  However,  DFAS  Kansas  City  did  not  make  the 
recommended  changes  and  continued  to  maintain  a  mailroom  within  the 
administrative  assistance  section  that  opened  and  date-stamped  the  mail.  Mail 
from  the  U.S.  Postal  Service  was  received  by  the  central  mailroom,  sorted,  and 
sent  unopened  to  the  administrative  assistance  section.  Packages  from  courier 
services  usually  bypassed  the  central  mailroom  and  were  delivered  directly  to  the 
administrative  assistance  section.  Facsimile  machines  that  received  vendor 
payment  documents  were  located  in  the  administrative  assistance  section.  The 
mailroom  in  the  administrative  assistance  section  was  not  in  a  secured  area  and 
technicians  were  allowed  to  pick  up  facsimile  documents  without  ensuring  that 
they  were  properly  date-stamped.  Since  the  date  stamp  on  the  invoice  is  a  key 
element  in  determining  prompt  payment  requirements,  DFAS  Kansas  City 
needed  to  move  the  opening  and  date-stamping  of  ah  incoming  vendor  payment 
documents  to  the  centralized  mailroom. 

Document  Management.  DFAS  Kansas  City  did  not  effectively  track, 
control,  and  screen  ah  documents  supporting  payments.  Beginning  in 
January  2000,  DFAS  Kansas  City  required  the  administrative  assistance  section 
to  open  and  log  all  incoming  documents  into  a  spreadsheet  and  then  pass  them  on 
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to  the  payment  teehnieians.  However,  doeuments  were  not  adequately  eontrolled 
and  the  sereening  of  doeuments  to  determine  eomplianee  with  5  C.F.R. 

Part  1315  requirements  did  not  take  plaee  early  enough  in  the  payment  proeess  to 
return  the  doeuments  and  make  eorreetions  within  the  prompt  payment 
timeframe. 


Tracking  Documents.  The  method  used  by  the  administrative 
assistanee  seetion  to  traek  doeuments  was  slow  and  ineffeetive.  The 
administrative  assistanee  seetion  entered  into  a  spreadsheet  all  doeuments 
reeeived  in  the  vendor  payment  offiee.  It  used  the  spreadsheet  to  traek 
doeuments;  however,  the  spreadsheet  did  not  eontain  detailed  information  as  to 
where  doeuments  eould  be  found  within  the  vendor  payment  offiee.  Between 
Oetober  31  and  November  9,  2000,  we  observed  that  mail  sat  in  erates  in  the 
administrative  assistanee  seetion  for  at  least  5  days  awaiting  entry  into  the 
spreadsheet.  Aeeounts  payable  teehnieians  stated  that  they  used  the  spreadsheet 
when  a  vendor  ealled  about  the  status  of  a  payment.  They  reviewed  the 
spreadsheet  to  determine  whether  the  invoiee  had  been  reeeived.  However,  they 
stated  that  they  often  did  not  seareh  the  offiee  for  missing  doeuments.  Instead, 
they  direeted  the  vendor  to  fax  in  a  new  invoiee.  One  teehnieian  told  us  that  the 
date  stamp  on  the  new  faesimile  doeument  was  used  in  eomputing  the  payment 
due  date  rather  than  the  invoiee  reeeipt  date  for  the  original  invoiee  in  the 
traeking  spreadsheet.  To  test  eontrols  over  the  traeking  of  doeuments,  we 
obtained  10  invoiees  from  the  mailroom  on  Oetober  31,  2000,  and  traeed  them 
through  the  vendor  payment  proeess  until  November  9,  2000.  In  order  to  loeate 
eaeh  of  the  invoiees,  teehnieians  had  to  sort  through  staeks  of  doeuments  in  and 
around  their  desks.  While  we  eventually  loeated  the  invoiees,  7  of  the 
10  invoiees  had  not  yet  been  entered  into  CAPS(W).  The  spreadsheet  should 
have  been  used  to  loeate  doeuments  within  DFAS  Kansas  City  and  determine 
invoiee  reeeipt  dates  for  lost  doeuments.  A  measurable  standard  for  entering 
doeuments  in  CAPS(W)  should  also  be  established  and  monitored. 

Controlling  Docnments.  DFAS  Kansas  City  did  not  effeetively 
eontrol  the  payment  folders  eontaining  invoiees,  reeeiving  reports,  and  obligation 
doeuments.  Ineoming  payment  doeuments  were  loosely  transferred  between  the 
administrative  assistanee  seetion  and  aeeounts  payable  teams,  often  more  than  a 
week  after  arriving  at  DFAS  Kansas  City.  Aeeounts  payable  teehnieians 
validated  invoiees  and  reeeiving  reports  against  the  eontraet  and  the  other 
supporting  doeumentation,  then  plaeed  the  doeuments  in  payment  folders.  In 
November  2000,  we  observed  staeks  and  boxes  of  payment  folders,  invoiees,  and 
reeeiving  reports  on  and  around  teehnieians’  desks.  Usually  these  piles  were 
sorted  aeeording  to  whether  the  doeuments  needed  to  be  entered  into  CAPS(W), 
the  payment  awaited  pre validation,  or  the  payment  needed  to  be  eomputed.  To 
loeate  a  payment  folder,  supervisors  had  to  find  the  teehnieian  responsible  for 
entering  the  data  into  CAPS(W)  and  then  have  that  teehnieian  look  through  the 
staeks  of  doeuments  in  and  around  the  desk  or  in  nearby  filing  eabinets.  To 
effeetively  eontrol  doeuments  supporting  vendor  payments,  DFAS  Kansas  City 
needs  to  establish  and  maintain  payment  folders  in  a  doeument  management 
seetion.  Maintaining  the  folders  in  a  doeument  management  seetion  would 
prevent  the  flow  of  loose  doeumentation  within  DFAS  Kansas  City.  By 
reviewing  operations  at  other  vendor  payment  offiees  using  CAPS(W),  two 
methods  were  identified  that  eould  be  used  within  the  doeument  management 
seetion  for  maintaining  effeetive  eontrol  over  payment  doeuments.  The 
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preferable  method  was  to  have  teehnieians  enter  data  into  CAPS(W).  Onee  the 
data  were  entered,  the  payment  folder  eould  then  be  signed  out  to  a  teehnieian  on 
an  aeeounts  payable  team  who  would  eompute  the  payment  after  verifying  the 
data  had  been  properly  entered  into  CAPS(W).  A  less  desirable,  but  aeeep table, 
means  for  managing  doeuments  and  payments  was  to  ereate  a  database  for 
traeking  doeuments  that  had  been  signed  out  to  aeeounts  payable  teams  for 
proeessing.  Onee  data  were  entered  into  CAPS(W),  the  teehnieian  would  return 
the  folder  to  the  doeument  management  seetion.  Folders  would  be  returned  to 
the  teehnieian  only  when  additional  doeuments  required  entry  into  CAPS(W)  or 
the  payment  needed  to  be  eomputed.  At  DFAS  Kansas  City,  the  aeeounts 
payable  teams  entered  invoiees  and  reeeiving  reports  into  CAPS(W),  eomputed 
payments,  and  eertified  payments.  Keeping  the  payment  folders  under  the  eontrol 
of  the  doeument  management  seetion  makes  it  easier  to  loeate  payment  folders 
and  other  doeuments. 

Screening  Docnments.  The  administrative  assistanee  seetion  did 
not  sereen  ineoming  doeuments  for  eomplianee  with  5  C.F.R.  Part  1315 
requirements.  An  effeetive  doeument  management  seetion  should  eonduet  a 
detailed  sereening  of  invoiees,  reeeiving  reports,  and  obligation  doeuments. 
Defieieneies  in  payment  doeuments  should  be  identified  and  promptly  returned  to 
originators  so  as  to  minimize  unneeessary  rework  later  in  the  payment  proeess. 

To  ensure  ineoming  doeuments  are  effeetively  sereened,  personnel  with  suffieient 
vendor  payment  experienee  and  knowledge  of  regulatory  proeedures  should  be 
assigned  to  the  doeument  management  seetion.  At  DFAS  Kansas  City,  doeument 
sereening  did  not  oeeur  until  the  aeeounts  payable  teehnieian  attempted  to  enter 
the  doeument  into  CAPS(W).  By  not  sereening  invoiees  and  reeeiving  reports 
upon  reeeipt,  payments  eould  be  delayed  and  interest  paid  when  teehnieians 
diseovered  errors  when  entering  the  data  into  CAPS(W).  As  stated  previously, 
only  3  of  the  10  invoiees  we  traeed  through  the  payment  proeess  were  entered 
into  CAPS(W)  within  9  days  of  reeeipt.  5  C.F.R.  Part  1315  requires  that 
improper  invoiees  be  returned  to  vendors  within  7  days.  Defieieneies  deteeted  in 
other  payment  doeuments  should  have  resulted  in  those  doeuments  being  returned 
to  the  originators.  However,  teehnieians  were  often  reluetant  to  return 
doeuments.  Delays  in  identifying  defieieneies  in  invoiees  and  reeeiving  reports 
eould  result  in  the  payment  of  interest  to  vendors. 

Payment  Processing.  DFAS  Kansas  City  had  not  ensured  that  quality  reviews 
of  supporting  doeuments  were  fully  performed  by  teehnieians  on  the  three 
aeeounts  payable  teams  who  entered  invoiees  and  reeeiving  reports  into 
CAPS(W).  In  addition,  eertifieation  offieials  were  not  organizationally 
independent  and  did  not  always  adequately  review  the  doeuments  supporting 
vendor  payments. 

Quality  Reviews  of  Supporting  Documents.  Accounts  payable 
technicians  did  not  perform  appropriate  reviews  to  determine  whether  invoices 
and  receiving  reports  complied  with  5  C.F.R.  Part  1315  requirements.  Accounts 
payable  technicians  usually  returned  invoices  for  reasons  such  as  missing 
descriptions,  missing  contract  numbers,  and  overbilling.  However,  the 
technicians  seldom  returned  invoices  with  poor  descriptions  of  goods  and 
services,  that  were  inconsistent  with  contracts,  or  that  had  been  altered.  The 
technicians  did  not  ensure  that  invoices  and  receiving  reports  met  all  5  C.F.R. 
Part  1315  requirements.  Technicians  seldom  questioned  the  need  for  required 
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information  missing  on  receiving  reports  or  returned  them  for  correction. 

Finding  B  discusses  the  reasons  why  payments  in  our  sample  were  not  properly 
supported.  Appendix  D  identifies  the  requirements  in  5  C.F.R.  Part  1315. 

Certification  of  Payment  Vonchers.  Certification  officials  did  not 
thoroughly  review  all  payments  and  supporting  documents  to  ensure  that  they 
were  accurate,  proper,  and  correct  for  payment.  Supporting  documents  were 
often  missing  some  of  the  information  required  to  make  proper  payments.  In 
addition,  certification  officials  were  not  organizationally  independent. 

Certifying  Procednres.  Certification  officials  did  not  always 
closely  review  the  documents  supporting  vendor  payments  to  ensure  that  they 
were  proper.  As  discussed  in  finding  B,  many  problems  were  identified  with  the 
invoices,  receiving  reports,  and  obligating  documents  that  supported  vendor 
payments  made  by  DFAS  Kansas  City.  Our  sample  showed  that  41  payments 
were  considered  improper  because  the  vendor  was  paid  the  incorrect  amount  or 
the  payment  should  not  have  been  made  based  on  the  supporting  documentation 
provided.  Certification  officials  did  not  detect  the  problems  with  the  payments. 
DFAS  Kansas  City  also  used  a  sampling  plan  that  was  incomplete  and  not 
properly  approved  to  certify  vendor  payments  under  $2,500.  To  alleviate  the 
certification  workload,  certification  officials  used  statistical  sampling  procedures 
for  examining  a  random  number  of  payment  vouchers  scheduled  for  payment. 
DoD  Regulation  7000. 14-R,  volume  5,  chapter  33,  “Accountable  Officials  and 
Certifying  Officers,”  August  1998,  allowed  for  a  prepayment  sampling  plan  for 
payments  provided  the  plan  was  approved  by  the  Office  of  the  Under  Secretary 
of  Defense  (Comptroller)  or  a  designee.  GAO  Policy  and  Procedures  Manual, 
Title  7,  “Fiscal  Guidance,”  May  18,  1993,  limits  this  authority  to  payments 
under  $2,500.  DFAS  Kansas  City  had  not  requested  nor  received  approval  for 
its  plan.  The  plan  was  based  on  information  developed  by  DFAS  Arlington. 
However,  the  plan  was  incomplete  and  not  always  followed.  DFAS  Kansas  City 
did  not  use  appropriate  sampling  techniques  and  the  results  of  the  sampling  were 
not  analyzed  to  determine  whether  the  risk  level  remained  acceptable  or  whether 
certification  of  individual  payments  should  be  resumed.  Although  the  use  of 
statistical  sampling  may  be  justified,  DFAS  Arlington  needs  to  closely  monitor 
the  development  and  use  of  statistical  sampling  plans  by  vendor  payment  offices. 
We  believe  that  a  separate  plan  for  sampling  miscellaneous  payments  may  need 
to  be  developed.  Miscellaneous  payments  were  subject  to  a  higher  risk  of  being 
improperly  or  erroneously  paid  because  of  the  lack  of  standard  procedures  for 
making  properly  supported  miscellaneous  payments,  especially  those  missing 
obligation  document  numbers  and  invoice  numbers. 

Organizational  Placement  of  Certification  Officials. 

Certification  officials  were  not  organizationally  independent.  Certification 
officials  were  the  lead  technicians  and  supervisors  assigned  to  the  accounts 
payable  teams.  Undue  influence  could  be  placed  on  technicians  by  lead 
technicians  and  supervisors.  In  August  2000,  the  DFAS  Arlington  Internal 
Review  Office  substantiated  allegations  of  password  sharing  among  technicians 
on  accounts  payable  teams  and  a  certification  official  at  DFAS  Kansas  City. 
Internal  controls  for  separation  of  duties  were  circumvented  when  the  supervisor 
asked  for  and  obtained  the  passwords  of  her  subordinates.  Her  actions  allowed 
one  individual  to  be  able  to  enter  and  approve  payments.  Although  fraud  was  not 
found,  the  potential  existed.  Certification  officials  should  be  removed  from  the 
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accounts  payable  teams  and  reassigned  to  a  separate  seetion  in  the  vendor 
payment  offiee.  Establishing  a  separate  group  of  eertifieation  offieials  would 
minimize  the  potential  for  undue  influenee  and  allow  for  an  independent  review 
of  all  payments  to  ensure  eomplianee  with  5  C.F.R.  Part  1315  requirements. 

Receiving  Reports.  DFAS  Kansas  City  was  not  using  an  available  CAPS(W) 
report  to  obtain  missing  reeeiving  reports.  A  signifieant  eause  of  interest 
payments  made  by  DFAS  Kansas  City  was  due  to  the  inability  to  obtain  proper 
reeeiving  reports  from  reeeiving  aetivities  at  installations.  As  of  Oetober  24, 
2000,  DFAS  Kansas  City  had  527  invoiees,  valued  at  $4.97  million,  that  were 
more  than  30  days  old,  but  had  not  been  paid  beeause  of  missing  reeeiving 
reports.  DFAS  Kansas  City  did  not  have  people  designated  to  aggressively  work 
with  reeeiving  aetivities  to  obtain  missing  doeuments  or  to  be  a  foeal  point  to 
resolve  problems  identified  in  the  payment  proeess.  Teehnieians  stated  that  they 
had  other  higher-priority  work  that  took  preeedenee.  CAPS(W)  report, 

“Invoiees  Without  Reeeiving  Reports,”  should  have  been  used  to  identify 
invoiees  that  had  been  entered  into  CAPS(W)  but  were  missing  reeeiving  reports. 
The  report  should  have  been  generated  weekly  and  sent  to  reeeiving  aetivities. 
DFAS  Kansas  City  had  ereated  a  separate  spreadsheet  based  on  information  from 
CAPS(W)  for  pre validating  payments.  Although  the  spreadsheet  was  provided  to 
fmaneial  managers,  it  was  not  sent  to  reeeiving  aetivities.  We  seleeted  10 
invoiees  on  the  CAPS(W)  report,  “Invoiees  Without  Reeeiving  Reports,”  as  of 
Oetober  30,  2000,  and  eontaeted  reeeiving  aetivities  as  neeessary.  The  review 
determined  that  DFAS  Kansas  City  and  Marine  Corps  reeeiving  aetivities  eould 
do  more  to  make  prompt  and  aeeurate  payments. 

•  We  eontaeted  Quantieo  Marine  Corps  Base,  Quantieo,  Virginia,  for 
reeeiving  reports  for  five  invoiees  for  monthly  maintenanee  serviees 
from  Oetober  1999  through  August  2000.  The  reeeiving  aetivity 
provided  us  with  a  reeeiving  report  for  the  invoiees  eovering  serviees 
from  Oetober  1999  through  April  2000.  After  we  provided  the 
reeeiving  report  to  the  aeeounts  payable  teehnieian,  the  invoiees  were 
paid  with  interest.  As  of  April  17,  2001,  a  reeeiving  report  had  not 
been  provided  for  serviees  from  May  through  August  2000. 

•  DFAS  Kansas  City  reeeived  five  invoiees  between  April  18  and  20, 
2000,  for  reeeipt  of  goods.  The  reeeiving  aetivity  told  us  that  a 
reeeiving  report  had  been  sent  to  DFAS  Kansas  City.  The  eopy  faxed 
to  us  indieated  the  reeeipt  of  some  goods  on  April  12,  2000.  We 
informed  the  reeeiving  aetivity  that  the  reeeiving  report  did  not  meet 
the  requirements  of  a  proper  reeeiving  report  and  asked  them  to  send 
in  a  more  detailed  reeeiving  report.  The  Vendor  Inquiry  System 
showed  on  February  17,  2001,  that  the  invoiees  were  paid  on 
February  7,  2001,  without  interest.  The  invoiee  reeeipt  date  was 
January  16,  2001,  and  reeeipt  and  aeeeptanee  oeeurred  on 
Deeember  12,  2000.  Further  analysis  showed  that  DFAS  Kansas  City 
returned  the  invoiees  to  the  vendor  on  January  2,  2001,  beeause  the 
vendor  had  ehanged  its  name  in  June  2000.  Sinee  DFAS  Kansas  City 
personnel  had  valid  invoiees  that  were  date-stamped  in  April  2000  and 
they  failed  to  return  them  to  the  vendor  within  7  days  of  reeeipt,  they 
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should  have  recalculated  the  invoice  receipt  date  based  on  the  number 
of  days  they  held  on  to  the  invoices.  The  vendor  was  due  about  $100 
in  interest. 

DFAS  Kansas  City  and  the  Marine  Corps  need  to  work  together  to  ensure  that 
receiving  reports  for  goods  and  services  are  obtained  promptly  upon  receipt  and 
acceptance.  CAPS(W)  report,  “Invoices  Without  Receiving  Reports,”  should  be 
routinely  used  to  identify  and  obtain  missing  receiving  reports.  Resolving  unpaid 
invoices  should  become  more  of  a  joint  effort  that  is  monitored  closely  to  ensure 
that  prompt  and  accurate  payments  are  made.  DFAS  Kansas  City  should  have 
individuals  designated  to  review  reports  that  indicate  problems  with  documents 
needed  to  support  payments  and  work  with  customers  to  receive  missing 
information. 

Management  Oversight 


Operational  reviews  directed  by  DFAS  Arlington  identified  problems  in  vendor 
payment  operations  at  DFAS  Kansas  City.  However,  DFAS  Kansas  City  did  not 
take  appropriate  actions  in  response  to  those  previously  identified  problems.  For 
example,  mailroom  functions  were  not  relocated  to  the  centralized  mailroom  and 
certification  officials  were  able  to  make  changes  to  vendor  payment  information. 
Also,  post-payment  reviews  were  not  routinely  performed  to  determine  whether 
payments  were  properly  supported  and  made  correctly.  Post-payment  reviews  of 
payment  vouchers  would  help  to  identify  problems  with  making  properly 
supported  vendor  payments.  DFAS  needed  to  ensure  that  prompt  corrective 
actions  were  taken  in  response  to  recommendations  of  operational  review  teams. 

Summary 


DFAS  Kansas  City  had  improved  the  segregation  of  duties  by  establishing  a  new 
vendor  payment  structure  and  limiting  access  to  CAPS(W).  However,  the 
Director,  Commercial  Pay  Services,  needed  to  change  the  business  structure  and 
practices  at  the  DFAS  Kansas  City  for  making  vendor  payments  to  ensure  that 
documents  are  properly  controlled,  information  in  CAPS(W)  is  correct  and 
properly  supported,  and  vendors  are  paid  promptly  and  accurately.  Emphasis 
needs  to  be  placed  on  determining  whether  supporting  documents  comply  with  all 
requirements.  If  proper  invoices,  receiving  reports,  and  obligation  documents 
are  not  received,  prompt  actions  must  to  be  taken  to  return  the  documents  to 
originators  and  request  proper  documentation.  DFAS  Kansas  City  and  the 
Marine  Corps  must  make  a  concerted  effort  to  ensure  that  proper  receiving 
reports  for  goods  and  services  are  obtained  promptly  upon  receipt  and 
acceptance.  To  maintain  proper  segregation  of  duties,  DFAS  Kansas  City  should 
make  sure  that  no  one  individual  can  enter  or  direct  the  entry  of  all  data  needed 
to  make  payments.  Certification  officials  should  be  organizationally  independent 
to  ensure  that  all  payments  are  accurate,  proper,  and  legal.  Responsive  actions 
need  to  be  taken  to  correct  previously  identified  problems  and  payment  vouchers 
should  be  reviewed  to  identify  problems  with  making  properly  supported 
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payments.  DFAS  must  also  develop  a  eomprehensive  program  to  provide 
personnel  assigned  to  the  vendor  payment  offiee  with  appropriate  training  on  the 
regulatory  requirements  for  making  properly  supported  payments. 


Recommendations,  Management  Comments,  and  Audit 
Response 


C.  We  recommend  that  the  Director,  Commercial  Pay  Services,  change  the 
bnsiness  strnctnre  and  practices  at  the  Defense  Finance  and  Acconnting 
Service  Kansas  City  for  making  vendor  payments  nsing  the  Compnterized 
Acconnts  Payable  System  for  Windows.  Specifically: 

1.  Receive  and  date-stamp  all  incoming  docnments  snpporting  vendor 
payments  in  a  central  location  ontside  the  vendor  payment  office. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  the  receipt  and  date-stamping  of  incoming  hard-copy  payment 
documents  was  moved  to  the  centralized  mailroom. 

2.  Establish  a  document  management  section  to  become  the  focal 
point  for  receipt,  screening,  and  control  of  all  documents  supporting  vendor 
payments. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  DFAS  will  develop  a  standard  organization  structure  for  all  vendor 
payment  sites.  The  new  structure  will  incorporate  organization  and  system 
controls  that  ensure  adequate  separation  of  duties  and  controls  over  documents. 

3.  Segregate  the  ability  to  enter  information  related  to  invoices  and 
receiving  reports  into  the  Computerized  Accounts  Payable  System  for 
Windows  from  the  ability  to  enter  purchase  order  data.  Alternatively, 
segregate  the  ability  to  enter  invoices,  receiving  reports,  and  obligating 
documents  from  the  ability  to  compute  payments. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  DFAS  will  review  system  access  profiles  in  CAPS(W)  to  ensure  that 
they  provide  adequate  separation  of  duties. 

4.  Develop  standards  for  entering  invoices  and  receiving  reports  into 
the  Computerized  Accounts  Payable  System  for  Windows. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  DFAS  will  modify  employees’  standards  to  address  the  quantity  and 
quality  of  invoices  and  receiving  reports  entered  into  CAPS(W). 

5.  Organizationally  separate  certification  officials  from  the  accounts 
payable  teams.  Establish  a  separate  section  within  the  vendor  payment 
office  for  certification  officials  who  ensure  that  payments  are  legal,  proper, 
and  correct  before  they  are  certified. 
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DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  DFAS  will  develop  a  standard  organization  structure  for  use  by  all 
vendor  payment  sites.  The  new  structure  will  ensure  increased  controls  over 
certification  duties. 

6.  Certify  individual  vendor  payments  until  a  sampling  plan  for 
certifying  a  representative  sample  of  contract  and  miscellaneous  payments  is 
developed  and  approved. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  partially  concurred 
and  stated  that  DFAS  will  use  the  DFAS  Arlington  statistical  sampling  guidance 
that  is  currently  in  coordination  for  performing  pre-  and  post-payment  reviews. 

Audit  Response.  The  DFAS  comments  were  partially  responsive.  The 
statistical  sampling  guidance  developed  by  DFAS  Arlington  has  not  been 
approved  by  the  Office  of  the  Under  Secretary  of  Defense  (Comptroller).  Until 
DFAS  Kansas  City  has  an  approved  statistical  sampling  plan,  DFAS  Kansas  City 
should  manually  certify  all  payment  vouchers.  We  request  that  DFAS  reconsider 
its  position  and  provide  additional  comments  to  the  final  report. 

7.  Designate  individuals  to  review  reports  that  indicate  problems  with 
documents  needed  to  support  payments  and  work  with  customers  to  receive 
missing  information.  Establish  a  reports  and  reconciliation  section  to  handle 
payment  anomalies  and  reconcile  system  reports. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  supervisors  review  and  disseminate  reports  identifying  invoices 
missing  receiving  reports  and  obligations  to  the  Marine  Corps  Liaison  Office. 
Supervisors  will  work  with  the  Marine  Corps  Liaison  Office  to  obtain  missing 
documents. 

Audit  Response.  The  DFAS  comments  were  generally  responsive.  The 
standard  organization  structure  that  DFAS  is  developing  should  include  a  reports 
and  reconciliation  section. 

8.  Perform  monthly  post-payment  voucher  reviews  to  ensure  that 
vendor  payments  are  properly  supported  and  to  identify  problem  areas. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  partially  concurred 
and  stated  that  post-payment  reviews  will  revert  to  monthly  if  the  quarterly 
reviews  identify  an  unacceptable  level  of  compliance. 

Audit  Response.  The  DFAS  comments  were  responsive.  We  agree  that 
quarterly  reviews  should  be  performed  only  if  they  show  that  a  very  high 
percentage  of  the  payments  are  properly  supported  and  made  correctly. 
Otherwise,  more  frequent  reviews  would  be  appropriate. 

9.  Develop  a  comprehensive  training  program  for  making  properly 
supported  vendor  payments. 

DFAS  Comments.  The  Director,  Commercial  Pay  Services,  concurred  and 
stated  that  DFAS  Kansas  City  developed  a  new  employee  training  program  and 
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provided  refresher  training  to  vendor  payment  personnel.  The  refresher  training 
eovered  the  problem  areas  identified  during  the  audit.  The  training  program  will 
be  updated  as  needed. 
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Appendix  A.  Audit  Process 


Scope 


Work  Performed.  The  controls  associated  with  CAPS(W)  and  its  computation 
of  vendor  payments  at  DFAS  Kansas  City  were  evaluated  including  the 
procedures  that  DFAS  Kansas  City  used  to  make  vendor  payments  to 
Marine  Corps  customers.  During  FY  2000,  75,861  vendor  payments,  valued  at 
about  $1.2  billion  were  made  by  DFAS  Kansas  City  using  CAPS(W).  A  random 
sample  of  208  of  the  17,983  payments  made  from  May  1  through  July  31,  2000, 
was  reviewed.  We  considered  the  organizational  and  system  changes  made  by 
DFAS  Kansas  City  since  July  31,  2000. 

General  Accounting  Office  High-Risk  Area.  GAO  identified  several  high-risk 
areas  in  the  DoD.  This  report  provides  coverage  of  the  Defense  Financial 
Management  and  information  Management  and  Technology  high-risk  areas. 


Methodology 


To  assess  controls  over  CAPS(W),  we  reviewed  the  system  access  lists, 
compared  the  access  levels  of  employees  to  their  job  position,  observed  system 
access  by  users,  and  discussed  procedures  for  controlling  and  changing 
passwords  with  system  personnel.  We  also  reviewed  system  manuals  and 
discussed  the  functionality  of  CAPS(W)  with  systems  personnel  at  DFAS  Kansas 
City  and  Indianapolis. 

From  data  files  obtained  from  DFAS  Kansas  City,  we  randomly  selected 
208  vendor  payments  made  using  CAPS(W)  from  May  1  through  July  31,  2000. 
See  Appendix  C  for  the  sampling  methodology.  From  October  2000  through 
April  2001,  we  reviewed  the  operations  and  support  for  the  payments  made  at 
DFAS  Kansas  City  to  determine  whether  payments  were  properly  authorized, 
approved,  and  supported.  Obligation  documents,  invoices,  receiving  reports, 
and  payment  vouchers  were  reviewed  for  accuracy  and  propriety.  We  compared 
payment  vouchers  to  source  documents  to  determine  whether  payments  were 
properly  supported,  in  the  correct  amount,  cited  proper  appropriation  data,  based 
on  the  correct  invoice  receipt  dates  and  receipt  and  acceptance  dates,  were 
properly  certified,  and  sent  to  the  correct  vendor  via  the  required  means  of 
delivery. 

We  also  reviewed  guidance  for  making  vendor  payments  and  compared  guidance 
issued  by  DFAS  Arlington  and  Kansas  City  with  guidance  in  5  C.F.R. 

Part  1315,  the  FAR;  DFARS  subpart  232.9;  and  DoD  Regulation  7000. 14-R, 
volumes  5  and  10.  We  contacted  selected  receiving  activities  to  determine 
whether  they  received  goods  and  services  for  which  payments  had  been  made. 
We  also  contacted  several  vendors  to  determine  the  status  of  invoices  and 
whether  payments  had  been  received. 
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We  assessed  improvements  in  vendor  payment  operations  by  assessing  ehanges  in 
guidanee  and  the  aetions  taken  by  DFAS  Kansas  City  and  the  Marine  Corps  in 
response  to  prior  reviews  of  vendor  payment  operations.  We  held  diseussions 
with  key  DFAS  Kansas  City  personnel  and  Marine  Corps  fmaneial  managers. 

We  also  determined  aetions  taken  to  resolve  older  unpaid  invoiees  by 
judgmentally  seleeting  10  invoiees  from  a  listing  of  unpaid  invoiees.  We 
determined  the  status  of  the  invoiees,  identified  problems  that  delayed  the 
payment  of  the  invoiees,  and  for  those  invoiees  that  were  paid  as  of  the  date  of 
our  visit,  we  reviewed  the  doeuments  supporting  the  payments. 

Use  of  Computer-Processed  Data.  Although  we  relied  on  eomputer-proeessed 
data  from  CAPS(W),  we  did  not  evaluate  the  adequaey  of  all  the  system’s 
general  and  applieation  eontrols.  We  determined  that  password  eontrols  over 
CAPS(W)  were  not  adequate  and  data  entered  at  one  loeation  eould  be  altered  or 
removed  by  individuals  at  other  loeations.  However,  we  established  data 
reliability  for  the  payments  we  reviewed  by  eomparing  data  output  to  souree 
doeuments  and  through  diseussions  with  vendors  and  reeeiving  aetivities.  Our 
tests  diselosed  that  the  data  were  suffieiently  reliable  to  support  the  audit 
eonelusions  and  recommendations. 

Audit  Type,  Dates,  aud  Staudards.  This  financial-related  audit  was  performed 
from  October  2000  through  May  2001.  We  did  our  work  in  accordance  with 
generally  accepted  Government  auditing  standards  except  that  we  were  unable  to 
obtain  an  opinion  on  our  system  of  quality  control.  The  most  recent  external 
quality  control  review  was  withdrawn  on  March  15,  2001,  and  we  will  undergo  a 
new  review. 

Contacts  During  the  Audit.  We  visited  or  contacted  individuals  and 
organizations  within  DoD.  Further  details  are  available  on  request. 


Management  Control  Program  Review 


DoD  Directive  5010.38  “Management  Control  (MC)  Program,”  August  26, 

1996,  and  DoD  Instruction  5010.40,  “Management  Control  (MC)  Program 
Procedures,”  August  28,  1996,  require  DoD  organizations  to  implement  a 
comprehensive  system  of  management  controls  that  provides  reasonable 
assurance  that  programs  are  operating  as  intended  and  to  evaluate  the  adequacy 
of  the  management  controls. 

Scope  of  Review  of  the  Management  Control  Program.  We  reviewed  the 
adequacy  of  management  controls  over  vendor  payments  made  using  CAPS(W). 
Specifically,  we  reviewed  management  controls  over  vendor  payments  at  DFAS 
Kansas  City.  We  also  reviewed  management’s  self-evaluation  of  those  controls. 

Adequacy  of  Management  Controls.  A  material  management  control  weakness 
as  defined  by  DoD  Instruction  5010.40  was  identified  in  controls  associated  with 
making  vendor  payments  using  CAPS(W).  Management  controls  were  not 
adequate  to  control  access  to  CAPS(W)  and  to  ensure  that  all  vendor  payments 
were  properly  supported  and  made  for  correct  amounts.  Recommendations  A. , 
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B.,  and  C.,  if  implemented,  will  improve  eontrols  over  vendor  payments.  A 
eopy  of  the  report  will  be  provided  to  the  senior  offieial  in  eharge  of  management 
eontrols  in  DFAS. 

Adequacy  of  Management’s  Self-Evaluation.  DFAS  Kansas  City  identified 
vendor  payments  as  an  assessable  unit  and,  in  our  opinion,  eorreetly  identified 
the  risk  assoeiated  with  vendor  payments  as  high.  DFAS  Kansas  City  reported 
problems  with  eontrols  over  the  proeessing  of  CAPS(W)  payments  as  material 
management  eontrol  weaknesses  in  its  FY  1999  Annual  Statement  of  Assuranee. 
DFAS  Kansas  City  reported  in  its  FY  2000  Annual  Statement  of  Assuranee  that 
it  had  improved  eontrols  over  the  proeessing  of  CAPS(W)  payments,  but 
reported  a  laek  of  internal  eontrols  over  aeeess  to  CAPS(W)  as  a  material 
management  eontrol  weakness.  DFAS  Kansas  City  indieated  that  resolution  of 
the  system  aeeess  problems  was  outside  its  eontrol  and  requested  assistanee  in 
resolving  them  from  DFAS  Arlington.  We  disagree  with  the  assertions  made  in 
the  FY  2000  Annual  Statement  of  Assuranee  that  DFAS  Kansas  City  had 
eorreeted  eontrol  weaknesses  in  vendor  payment  operations  and  taken  all  the 
aetions  it  eould  to  improve  aeeess  to  CAPS(W).  As  highlighted  in  this  report, 
the  management  eontrol  weaknesses  related  to  CAPS(W)  in  the  FYs  1999  and 
2000  Annual  Statements  of  Assuranee  still  exist.  Additional  system  weaknesses 
also  exist  that  have  not  been  reported.  DFAS  Kansas  City  should  either  eorreet 
identified  material  eontrol  weaknesses  related  to  making  payments  using 
CAPS(W)  or  report  them  as  a  material  management  eontrol  weakness. 
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Appendix  B.  Prior  Coverage 


During  the  last  5  years,  GAO  and  the  Inspeetor  General,  DoD,  have  issued 
several  audit  reports  diseussing  issues  related  to  vendor  payments. 

General  Accounting  Office 


GAO  Report  No.  GAO-01-309  (OSD  Case  No.  3029),  “Exeess  Payments  and 
Underpayments  Continue  to  be  a  Problem  at  DoD,”  February  22,  2001 

GAO  Report  No.  GAO/AIMD-00-10  (OSD  Case  No.  1919),  “Inereased 
Attention  Needed  to  Prevent  Billions  in  Improper  Payments,”  Oetober  29,  1999 

GAO  Report  No.  GAO/AIMD-98-274  (OSD  Case  No.  1687),  “Improvements 
Needed  in  Air  Foree  Vendor  Payment  Systems  and  Controls,”  September  28, 
1998 

GAO  Report  No.  GAO/OSI-98-15  (OSD  Case  No.  1687-A),  “Fraud  by  an 
Air  Foree  Contraeting  Offieial,”  September  23,  1998 

Inspector  General,  DoD 


Inspeetor  General,  DoD,  Report  No.  D-2000-139,  “Controls  Over  the  Integrated 
Aeeounts  Payable  System,”  June  5,  2000 

Inspeetion  General,  DoD,  Report  No.  97-052,  “Vendor  Payments  -  Operation 
Mongoose,  Fort  Belvoir  Defense  Aeeounting  Offiee  and  Rome  Operating 
Loeation,”  Deeember23,  1996 
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Appendix  C.  Statistical  Sampling  Methodology 


Sampling  Plan 


Sampling  Purpose.  The  purpose  of  the  statistieal  sampling  plan  was  to  estimate 
the  number  of  vendor  payments  that  did  not  have  proper  doeumentation  by  type 
of  payment  and  type  of  doeument.  The  statistieal  sampling  plan  was  also  used 
to  estimate  the  number  of  improper  payments,  onee  it  was  determined  that  a 
payment  was  not  properly  supported.  The  payments  were  reviewed  to 
determine  whether  doeumentation  was  adequate  and  eomplied  with  5  C.F.R. 
Part  1315  requirements. 

Universe  Represented.  DFAS  Kansas  City  provided  a  database  of  vendor 
payments  made  using  CAPS(W)  from  May  1  through  July  31,  2000.  The  file 
eontained  reeords  on  17,987  vendor  payments.  The  total  dollar  value  of  the 
vendor  payments  in  the  population  was  $290.6  million. 

Sampling  Design.  The  sampling  design  used  to  determine  whether  or  not  the 
vendor  payments  had  proper  doeumentation  was  a  stratified  attribute  design. 

The  population  was  divided  into  three  strata:  payments  valued  at  less  than 
$2,500,  payments  valued  at  least  $2,500  but  less  than  $1  million,  and  payments 
valued  at  $1  million  or  more.  A  total  of  208  payments  (101  eontraetual  and  107 
miseellaneous)  were  randomly  seleeted;  130  from  the  first  stratum,  60  from  the 
seeond  stratum,  and  18  from  the  third  stratum. 

Sampling  Results 


Table  C-1  identifies  the  statistieal  estimates  of  vendor  payments  that  were  not 
properly  supported  by  type  of  payment. 


Table  C-1.  Payments  Not  Properly  Supported 
(99-Percent  Confidence  Level) 

Type  of 
Payment 

Lower  Bound 

Point  Estimate 

Upper  Bound 

eontraetual 

5,921 

7,511 

9,100 

Miseellaneous 

7,457 

9,094 

10,731 

We  are  99-pereent  eonfident  that  from  5,921  to  9,100  eontraetual  vendor 
payments  were  not  properly  supported.  Also,  we  are  99-pereent  eonfident  that 
from  7,457  to  10,731  miseellaneous  vendor  payments  were  not  properly 
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supported.  Table  C-2  identifies  the  statistieal  estimates  of  eontraetual  vendor 
payments  that  were  not  properly  supported  by  doeument  type. 


Table  C-2.  Contractual  Payments  Not  Properly 

Supported  by  Document  Type 
(99-Percent  Confidence  Level) 

Type  of 
Doeument 

Lower  Bound 

Point  Estimate 

Upper  Bound 

Invoiees 

1,671 

2,916 

4,160 

Reeeiving 

Reports 

5,727 

7,315 

8,904 

Contraets 

(17) 

604 

1,225 

We  are  99-pereent  eonfident  that  from  1,671  to  4,160  vendor  payments  were  not 
properly  supported  due  to  improper  invoiees.  We  are  99-pereent  eonfident  that 
from  5,727  to  8,904  vendor  payments  were  not  properly  supported  due  to 
improper  reeeiving  reports.  The  estimates  of  vendor  payments  that  were  not 
properly  supported  by  eontraet  passes  through  zero;  therefore,  the  estimate  for 
eontraets  is  not  eonsidered  signifieantly  different  than  zero  and  will  not  be  used 
in  the  report.  We  are  also  99-pereent  eonfident  that  from  933  to  3,053 
payments  were  made  using  reeeiving  reports  eontaining  inaeeurate  dates.  Eaeh 
of  the  individual  estimates  is  projeeted  at  the  99-pereent  eonfidenee  level. 
However,  taking  a  eonservative  approaeh,  reviewing  eaeh  of  the  10  estimates  as 
an  independent  projeetion,  we  estimate  the  overall  eonfidenee  level  for  all  10 
estimates  simultaneously  is  approximately  90-pereent. 

Table  C-3  identifies  the  statistieal  estimates  of  miseellaneous  vendor  payments 
that  were  not  properly  supported  by  doeument  type. 


Table  C-3.  Miscellaneous  Payments  Not  Properly 

Supported  by  Document  Type 
(99-Percent  Confidence  Level) 

Type  of 
Doeument 

Lower  Bound 

Point  Estimate 

Upper  Bound 

Invoiees 

(64) 

463 

990 

Reeeiving 

Reports 

6,985 

8,614 

10,244 

Obligation 

Doeuments 

251 

1,032 

1,813 
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We  are  99-pereent  eonfident  that  from  6,985  to  10,244  vendor  payments  were 
not  properly  supported  due  to  improper  reeeiving  reports.  We  are  99-pereent 
eonfident  that  from  251  to  1,813  vendor  payments  were  not  properly  supported 
due  to  improper  obligation  doeuments.  The  estimates  of  vendor  payments  that 
were  not  properly  supported  by  invoiees  passes  through  zero;  therefore,  the 
estimate  for  eontraets  is  not  eonsidered  signifieantly  different  than  zero  and  will 
not  be  used  in  the  report.  Eaeh  of  the  individual  estimates  is  projeeted  at  the 
99-pereent  eonfidenee  level.  However,  taking  a  eonservative  approaeh, 
reviewing  eaeh  of  the  10  estimates  as  an  independent  projeetion,  we  estimate  the 
overall  eonfidenee  level  for  all  10  estimates  simultaneously  is  approximately 
90-pereent. 

Table  C-4  identifies  the  statistieal  estimates  of  eontraetual  and  miseellaneous 
payments  that  were  improper  payments. 


Table  C-4.  Improper  Payments 
(99-Percent  Confidence  Level) 

Type  of 
Payment 

Lower  Bound 

Point  Estimate 

Upper  Bound 

eontraetual 

1,617 

2,845 

4,073 

Miseellaneous 

190 

926 

1,661 

We  are  99-pereent  eonfident  that  from  1,617  to  4,073  eontraetual  payments 
were  improper  payments.  Also,  we  are  99-pereent  eonfident  that  from  190  to 
1,661  miseellaneous  payments  were  improper  payments.  Improper  payments 
were  payments  that  should  not  have  been  made  or  were  made  for  ineorreet 
amounts.  Speeifieally,  improper  payments  ineluded  payments  for  unsupported 
or  inadequately  supported  elaims,  overpayments,  and  underpayments. 
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Appendix  D.  Guidance  on  Supporting 

Documentation 


The  principal  guidance  used  for  making  payments  to  vendors  is  the  PPA,  as 
implemented  by  0MB  in  5  C.F.R.  Part  1315,  “Prompt  Payment;  Final  Rule,” 
September  29,  1999.  The  requirements  for  supporting  documentation  are 
further  defined  in  FAR  subpart  32.9,  “Prompt  Payment;”  DFARS  subpart 
232.9,  “Prompt  Payment;”  and  DoD  Regulation  7000. 14-R,  volume  10, 
“Contract  Payment  Policy  and  Procedures,”  November  1999. 

On  August  28,  2000,  a  proposed  rule  was  published  for  comment  in  the  Federal 
Register  “Federal  Acquisition  Regulation;  Prompt  Payment  and  the  Recovery  of 
Overpayment;  Proposed  Rule.”  The  proposed  change  revises  the  FAR  to 
incorporate  5  C.F.R.  Part  1315  and  implements  a  GAO  recommendation  to 
require  contractors  who  have  been  overpaid  to  notify  contracting  officers  of 
overpayments.  The  FAR  council  must  issue  a  Federal  Acquisition  Circular  to 
change  the  FAR.  DFARS  subpart  232.9,  also  has  not  been  changed. 

In  Inspector  General,  DoD,  Report  No.  D-2000-139,  “Controls  Over  the 
Integrated  Accounts  Payable  System,”  June  5,  2000,  we  recommended  that 
DoD  Regulation  7000. 14-R,  volume  10,  be  amended  to  fully  comply  with 
5  C.F.R.  Part  1315  requirements  and  include  standardized  rules  for  making 
properly  supported  miscellaneous  payments.  DoD  Regulation  7000. 14-R, 
volume  10,  has  not  yet  been  changed.  The  Under  Secretary  of  Defense 
(Comptroller)  stated  that  DoD  Regulation  7000. 14-R,  volume  10,  would  not  be 
changed  until  5  C.F.R.  Part  1315  is  incorporated  in  the  FAR. 

DFAS  Kansas  City  issued  revised  vendor  pay  standard  operating  procedures  in 
October  2000.  However,  the  DFAS  Kansas  City  guidance  did  not  include  the 
requirements  in  5  C.F.R.  Part  1315. 

Invoices.  5  C.F.R.  Part  1315  requires  that  the  vendor  send  an  invoice  to  the 
designated  billing  office  specified  in  the  contract  when  goods  are  delivered  or 
services  performed.  The  designated  billing  office  is  required  to  immediately 
date-stamp  the  invoice  and  perform  a  review  to  determine  whether  the  invoice  is 
proper  for  payment.  If  the  invoice  is  determined  to  be  proper,  it  should  be  sent 
to  the  payment  office  for  entry  into  CAPS(W)  and  payment.  If  determined  to  be 
improper,  the  invoice  should  be  returned  to  the  vendor  within  7  days  of  receipt 
(for  most  invoices),  identifying  all  defects  that  prevented  payment  and 
requesting  that  the  vendor  send  a  clearly  marked  corrected  invoice  to  the 
designated  billing  office  for  payment. 

Specifically,  5  C.F.R.  Part  1315.9,  “Required  Documentation,”  states  that: 

(b)  The  following  correct  information  constitutes  a  proper  invoice  and 

is  required  as  payment  documentation: 

(1)  Name  of  vendor; 
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(2)  Invoice  date; 

(3)  Government  contract  number,  or  other  authorization  for  delivery 
of  goods  or  services; 

(4)  Vendor  invoice  number,  account  number,  and/or  any  other 
identifying  number  agreed  to  by  contract; 

(5)  Description  (including  for  example,  contract  line/subline 
number),  price,  and  quantity  of  goods  and  services  rendered; 

(6)  Shipping  and  payment  terms  (unless  mutually  agreed  that  this 
information  is  only  required  in  the  contract); 

(7)  Taxpayer  Identification  Number  (TIN),  unless  agency  procedures 
provide  otherwise; 

(8)  Banking  information,  unless  agency  procedures  provide 
otherwise,  or  except  in  situations  where  the  EFT  requirement  is 
waived  under  31  CFR  208.4; 

(9)  Contact  name  (where  practicable),  title  and  telephone  number; 

(10)  Other  substantiating  documentation  or  information  required  by 
the  contract. 

In  addition  to  these  requirements,  the  proposed  ehange  to  the  FAR  speeifies  EFT 
requirements  and  states  that  eontraetors  should  assign  an  identifieation  number  to  eaeh 
invoiee. 

DoD  Regulation  7000. 14-R,  volume  10,  allows  exeeptions  to  requirements  for  a  valid 
invoiee.  DoD  Regulation  7000. 14-R,  volume  10,  states  that  it  is  not  neeessary  for  an 
invoiee  to  be  free  of  defeets  in  order  for  it  to  be  proper  and  ereate  a  valid  demand  on 
the  Government;  the  approving  aetivity  determines  whether  a  valid  demand  exists. 
These  exeeptions  are  eontrary  to  5  C.F.R.  Part  1315  and  FAR  requirements.  The 
ehapters  of  DoD  Regulation  7000. 14-R  have  not  been  updated  sinee  1996  and  state  that 
if  ineonsisteneies  exist  between  the  FAR  and  the  regulation,  the  FAR  eontrols.  In 
assessing  whether  an  invoiee  was  proper,  we  used  5  C.F.R.  Part  1315  requirements. 
Speeifieally,  invoiees  were  eonsidered  improper  if  they  did  not  eontain  a  eontraet  or 
obligating  doeument  number,  or  did  not  adequately  deseribe  what  was  purehased  or  the 
deseription  was  ineonsistent  with  the  eontraet.  The  FAR  requires  that  an  invoiee  that  is 
missing  required  data  be  returned  to  the  vendor  within  7  days  of  reeeipt,  whieh  ean 
make  the  needed  eorreetions  and  resubmit  a  elearly  marked  eorreeted  invoiee. 
Consequently,  invoiees  were  also  eonsidered  improper  if  they  were  altered. 

Receiving  Reports.  5  C.F.R.  Part  1315  requires  that  reeeipt  and  aeeeptanee  be 
promptly  reeorded  at  the  time  of  delivery  of  goods  or  eompletion  of  serviees. 

Reeeiving  aetivities  were  required  to  submit  a  reeeiving  report  immediately  upon  eaeh 
delivery  of  goods  or  eompletion  of  serviees  unless  the  eontraet  stated  that  partial 
payment  was  not  authorized.  Reeeiving  aetivities  were  to  forward  a  proper  reeeiving 
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report  to  the  payment  offiee  by  the  fifth  working  day  after  aeeeptanee.  5  C.F.R. 
Part  1315.9  states  that: 

(c)  The  following  information  from  receiving  reports,  delivery  tickets, 
and  evaluated  receipts  is  required  as  payment  documentation: 

(1)  Name  of  vendor; 

(2)  Contract  or  other  authorization  number; 

(3)  Description  of  goods  or  services; 

(4)  Quantities  received,  if  applicable; 

(5)  Date(s)  goods  were  delivered  or  services  were  provided; 

(6)  Date(s)  goods  or  services  were  accepted; 

(7)  Signature  (or  electronic  alternative  when  supported  by 
appropriate  internal  controls),  printed  name,  telephone  number, 
mailing  address  of  the  receiving  official,  and  any  additional 
information  required  by  the  agency. 

The  proposed  ehange  to  the  FAR  basieally  restates  existing  requirements 
for  reeeiving  reports.  The  proposed  ehange  states  that: 

(c)  Authorization  to  pay.  .  .  .The  receiving  report  or  other 
Government  documentation  authorizing  payment  must,  as  a  minimum, 
include  the  following: 

(1)  Contract  number  or  other  authorization  for  supplies  delivered  or 
services  performed. 

(2)  Description  of  supplies  delivered  or  services  performed. 

(3)  Quantities  of  supplies  received  and  accepted  or  services 
performed,  if  applicable. 

(4)  Date  supplies  delivered  or  services  performed. 

(5)  Date  that  the  designated  Government  Qfficial  - 

(i)  Accepted  the  supplies  or  services;  or 

(ii)  Approved  the  progress  payment  request,  if  the 
request  is  being  made  under  the  clause  at  52.232-5, 
Payments  Under  Fixed-Price  Construction 
Contracts,  or  the  clause  at  52.232-10,  Payment 
Under  Fixed-Price  Architect-Engineering  Contracts. 
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(6)  Signature,  printed  name,  title,  mailing  address,  and  telephone 
number  of  the  designated  Government  official  responsible  for 
acceptance  or  approval  functions. 

DoD  Regulation  7000. 14-R,  volume  10,  does  not  speeify  what  a  reeeiving 
report  must  eontain  to  properly  support  a  payment.  Most  items  in  the  sample 
were  missing  the  dates  of  aeeeptanee  and  required  signature  information. 

Contracts.  To  properly  support  a  payment,  the  paying  offiee  must  have  a 
signed  eontraet  or  other  authorization  doeument  against  whieh  payment  is  being 
made.  5  C.F.R.  Part  1315.9  states  that: 

(а)  The  following  information  from  the  contract  is  required  as 

payment  documentation: 

(1)  Payment  due  date(s)  as  defined  in  Sec.  1315.4(g); 

(2)  A  notation  in  the  contract  that  Partial  payments  are  prohibited,  if 
applicable; 

(3)  For  construction  contracts,  specific  payment  due  dates  for 
approved  progress  payments  or  milestone  payments  for  completed 
phases,  increments,  or  segments  of  the  project; 

(4)  If  applicable,  a  statement  that  the  special  payment  provisions  of 
the  Packers  and  Stockyard  Act  of  1921  (7  U.S.C.  182(3)),  or  the 
Perishable  Agricultural  Commodities  Act  of  1930  (7  U.S.C. 

499a(4)),  or  Fish  and  Seafood  Promotion  Act  of  1986  (16  U.S.C. 

4003(3))  shall  apply; 

(5)  Where  considered  appropriate  by  the  agency  head,  the  specified 
acceptance  period  following  delivery  to  inspect  and/or  test  goods 
furnished  or  to  evaluate  services  performed  is  stated; 

(б)  Name  (where  practicable),  title,  telephone  number,  and  complete 
mailing  address  of  officials  of  the  Government’s  designated 
agency  office,  and  of  the  vendor  receiving  the  payments; 

(7)  Reference  to  requirements  under  the  Prompt  Payment  Act, 
including  the  payment  of  interest  penalties  on  late  invoice 
payments  (including  progress  payments  under  construction 
contracts); 

(8)  Reference  to  requirements  under  the  Debt  Collection 
Improvement  Act  (Pub.  L.  104-134,  110  Stat.  1321)  including  the 
requirement  that  payments  must  be  made  electronically  except  in 
situations  where  the  EFT  requirement  is  waived  under  31  CFR 
208.4.  Where  electronic  payment  is  required,  the  contract  will 
stipulate  that  banking  information  must  be  submitted  no  later  than 
the  first  request  for  payment. 
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Many  contracts  were  missing  key  elements  sueh  as  payment  terms,  a  valid 
DUNS  number,  or  a  valid  CAGE  eode.  Although  the  laek  of  this  information 
did  not  make  the  eontraet  improper,  it  made  proper  payment  diffieult.  For 
example,  eontraets  should  have  eontained  a  DUNS  number  or  CAGE  eode 
beeause  one  was  needed  to  loeate  EFT  information  for  payment  in  the 
Contraetor  EFT  database. 
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Appendix  E.  Report  Distribution 


Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition,  Technology,  and  Logistics 
Deputy  Under  Secretary  of  Defense  (Acquisition  Reform) 

Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 


Department  of  the  Army 

Auditor  General,  Department  of  the  Army 


Department  of  the  Navy 

Commandant,  United  States  Marine  Corps 

Deputy  Chief  of  Staff  for  Installations  and  Logistics 
Naval  Inspector  General 

Deputy  Naval  Inspector  General  for  Marine  Corps  Matters 
Auditor  General,  Department  of  the  Navy 


Department  of  the  Air  Force 

Auditor  General,  Department  of  the  Air  Force 


Other  Defense  Organizations 

Director,  Defense  Finance  and  Accounting  Service 
Director,  Commercial  Pay  Services 


Non-Defense  Federal  Organization 

Office  of  Management  and  Budget 


Congressional  Committees  and  Subcommittees,  Chairman  and 
Ranking  Minority  Member 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
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Congressional  Committees  and  Subcommittees,  Chairman  and 
Ranking  Minority  Member  (cont’d) 

House  Committee  on  Appropriations 

House  Subeommittee  on  Defense,  Committee  on  Appropriations 
House  Committee  on  Armed  Serviees 
House  Committee  on  Government  Reform 

House  Subeommittee  on  Government  Effieieney,  Finaneial  Management,  and 
Intergovernmental  Relations,  Committee  on  Government  Reform 
House  Subeommittee  on  National  Seeurity,  Veterans  Affairs,  and  International 
Relations,  Committee  on  Government  Reform 
House  Subeommittee  on  Teehnology  and  Proeurement  Poliey,  Committee  on 
Government  Reform 
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Under  Secretary  of  Defense  for 
Acquisition,  Technology,  and  Logistics 
Comments 


OFFICE  OF  THE  UNDER  SECRETARY  OF  DEFENSE 

3000  DEFENSE  PENTAGON 
WASHINGTON.  DC  20301-3000 

AUG  20 


MEMORANDUM  FOR  DIRECTOR,  FINANCE  AND  ACCOUN':’ FNCt  DIRECTORATE, 
DOD  INSPECTOR  GENERAL 

THROUGH:  DIRECTOR,  ACQUISITION  RESOURCES  S-  ANALYSIS 

SUBJECT;  DoDIG  Draft  Report  on  Controls  Over  the  Computer i  7;ed 
Accounts  Payable  System  at  Detense  Fxnance  and 
Accountiiig  Service  Kansas  City  (Project  No. 
D2000FI-0248) 


This  is  in  response  to  your  nemoranduir.  ot  June  18,  2001,  uo 
the  Under  Secretary  of  Defense  for  Acquisition,  Technology  and 
LogisL.:.cs  -requesting  comments  on  the  subject  draft  report.  The 
comments  provided  bolov/  relate  to  Recommendation  B.l.  and  the 
related  findings. 

The  DoDIG  review  of  the  Computerized  Accounts  Payable 
System  (CAPS)  at  DFAS  Kansas  City  found  that  most  ot  the  sampled 
cjuiitiaot.  and  mi scell fineous  vendor  payrr.cnt.c  lack-od  at  loaKL  or.Q 
element  ot  support  prescribed  in  regulations  imp!  einonting  the 
Prompt  Payment  Act  (PPA)  .  The  report  noted,  hov/ever,  that  a 
[jaymerit  that  was  not  propexly  supporLed  did  not  mean,  that  the 
payment  was  invalid  or  fraudulent.  The  lack  ot  proper 
documentation  was  generally  attributed  to  the  use  cf  forms,  such 
as  locally  developed  forms,  that  were  used  to  indioato  xtceipr 
and  acceptance  of  goods  and  services  but  were  not  designed  as 
receiving  report,?.  Consequently,  the  forms  did  no::  contain 
space  for  required  information. 

T  concur  w’ich  Recommendation  B.l.  of  the  subject  report 
recomr'.ending  the  use  of  DD  Form  250,  Material  Inspection  and 
Receiving  Report,  as  the  primary  means  for  documenting  receipt 
and  acceptance  of  goods  and  services.  The  DD  Form.  250  (revised 
August  2000; ,  when  completed  correctly,  meets  all  the  PPA 
requirem.ents  for  a  proper  receiving  report.  1  also  concur  with 
the  reported  finding  that  other  standard  forrr.s,  such  as  DD  For:n 
1155,  Order  for  Supplies  or  Services,  may  be  used  for  making 
final  payments,  provided  they  contain  all  of  the  roqui.rod  data 
clcmcnLc.  Notwithstanding,  I  will  rnrjiiR.sr  the  Defense 


ACQUISIT'nM. 
TECHNOLOGY 
AND  LOGISTICS 


DP/CPF 
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Acquisition  Regulations  Council  to  tak©  the  necessary  actions 
revise  DFARS  Subpart  232.9,  Prompt  Payment,  to  specify  the  use 
of  DD  Form  250  as  the  primary  means  for  documenting  receipt  and 

acceptance  of  goods  and  services.  This  effort  will  be 
coordinated  vjith  the  Director,  DFAS  and  the  Military 
B.epartments . 

Thank  you  for  providing  us  the  opportunity  to  comment  on 
the  draft  report. 


Deidre  A.  Lee 

Director.  Defense  Procuremen 


Defense  Finance  and  Accounting  Service 
Comments 


IN  REPUY 
HEFERTO 


DFAS-BS/CC 


DEFENSE  FINANCE  AND  ACCOUNTING  SERVICE 
COLUMBUS  CENTER 

P.O.BOX  182317 
COLUMBUS.  OHIO  43218-2317 


SEP  1  7  2D01 


MEMORANDUM  FOR  DIRECTOR,  FINANCE  AND  ACCOUNTING  DIRECTORATE, 

OFFICE  OF  THE  INSPECTOR  GENERAL.  DEPARTMENT  OF 
DEFENSE 

SUBJECT:  Controls  Over  the  Computerized  Accounts  Payable  System  at  Defense  Finance  and 
Accounting  Service  Kansas  City  (Project  No.  D2000FI-0248) 


As  requested  in  your  June  18,  2001,  memorandum,  the  subject  audit  report  has  been 
reviewed.  Our  comments  and  corrective  actions  to  the  subject  recommendations  are  attached. 

The  original  date  for  implementation  of  DPPS  at  DFAS  Kansas  City  was  December 
2001 ,  The  date  has  slipped  and  the  schedule  for  implementation  at  Kansas  City  is  still  under 
review. 


If  you  have  any  questions,  please  contact  Mr.  Gary  Bethea,  DFAS-BSPC/CC,  at 
DSN  869-0840  or  614  693-0840. 


JoAnn  Boutelle 

Director,  Commercial  Pay  Services 


Attachment 
As  stated 
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Status  of  Action  Items,  DoD  IG  Audit  D2000FI-0248, 
Controls  Over  the  Computerized  Accounts  Payable  System  at  Defense 
Finance  and  Accounting  Service  Kansas  City 


Recommendation  A.l:  We  recommend  that  the  Director,  Commercial  Pay  Services,  establish 
compensating  controls  at  the  Defense  Finance  and  Accounting  Service  Kansas  City  that  will 
restrict  the  access  granted  under  the  "Financial  Systems  Directorate  Support"  and  "System 
Admin"  profiles  to  system  related  functions  for  specific  periods  of  time. 

DFAS  Management  Comments:  Concur,  The  Commercial  Pay  Business  Line  (CPBL)  will 
review  the  profiles  in  CAPS-W  and  ensure  adequate  separation  of  duties. 

Estimated  Completion  Date:  December  30,  2001, 


Recommendation  A.2:  Ensure  a  Defense  Information  Security  Agency  Form  41,  "System 
Authorization  Access  Request."  is  properly  completed  and  on  file  before  granting  access  to  the 
Computerized  Accounts  Payable  System  for  Windows. 

DFAS_Management  Comments:  Concur.  The  CPBL  will  ensure  DISA  Form  41  is  completed 
before  access  is  granted  to  CAPS-W  and  will  ensure  all  personnel  currently  with  access  to 
CAPS-W  has  a  DISA  Form  41  on  file. 

Estimated  Completion  Date:  December  30,  2001. 


Recommendation  A.3:  We  recommend  that  the  Director,  Commercial  Pay  Services,  establish 
compensating  controls  at  the  Defense  Finance  and  Accounting  Service  Kansas  City  that  will 
limit  access  to  update  vendor  maintenance  tables  and  eliminate  other  types  of  update  access 
granted  to  individuals  with  vendor  maintenance  access. 

DFAS  Management  Comments:  Concur.  The  CPBL  will  review  the  profiles  in  CAPS-W  and 
ensure  adequate  separation  of  duties. 

Estimated  Completion  Date:  December  30,  2001, 


Recommendation  A.4:  Limit  the  ability  to  delete  data  from  the  Computerized  Accounts 
Payable  System  for  Windows  and  establish  audit  trails  for  data  removed  from  the  system. 

DFAS  Management  Comments:  Concur.  The  CPBL  will  review  the  profiles  in  CAPS-W  and 
ensure  adequate  separation  of  duties. 

Estimated  Completion  Date:  December  30,  2001. 
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Recommendation  A.S:  Limit  the  use  of  the  miscellaneous  payments  fiinction  to  nonrecurring 
payments. 

DFAS  Management  Comments:  Concur  The  CPBL  will  review  the  profiles  in  CAPS-W  and 
ensure  adequate  separation  of  duties. 

Estimated  Completion  Pate:  December  30,  2001. 


Recommendation  A.6:  Remove  remote  access  to  update  and  certify  information  in  the 
Computerized  Accounts  Payable  System  for  Windows  until  the  system  can  provide  proper 
segregation  of  duties  and  security  over  remotely  entered  data. 

DFAS  Management  Comments:  Nonconcur.  The  Marine  Corps  manages  the  entitlement  and 
certification  of  utility  payments  for  their  13  sites  using  a  CAPS-W  database  that  is  exclusive  for 
Marine  Corps  payments.  The  CPBL  will  work  with  the  Marine  Corps  to  ensure  there  are 
procedures  in  place  for  their  certifying  officials  to  only  certify  payments  belonging  to  the 
certifying  official’s  organization. 


Recommendation  B.1:  We  recommend  that  the  Under  Secretary  of  Defense  (Acquisition, 
Technology,  and  Logistics),  in  coordination  with  the  Director,  Defense  Finance  and  Accounting 
Service,  and  the  Military  Services,  require  the  use  of  the  DD  Form  250,  "Material  Inspection  and 
Receiving  Repon,"  as  the  primary  means  for  documenting  receipt  and  acceptance  of  goods  and 
services. 

DFAS  Management  Comments:  Partially  Concur.  DFAS  does  not  establish  policy  for  DoD. 
DFAS  will  enforce  policy  to  require  the  use  of  DD  Form  250  if  policy  is  issued  by  USD(AT&L) 
and  USD(C). 

Estimated  Completion  Date:  To  be  established  by  USD  (AT&L)  and  USD(C). 

Recommendation  B.2:  We  recommend  that  the  Director,  Commercial  Pay  Services,  issue 
interim  guidance  until  DoD  Regulation  7000. 14-R,  volume  10,  is  changed.  The  guidance  should 
discontinue  exceptions  to  the  requirements  for  a  proper  invoice,  specify  what  a  receiving  report 
must  contain  to  properly  support  a  payment,  and  standardize  the  rules  for  making  properly 
supported  miscellaneous  payments. 

DFAS  Management  Comments:  Partially  Concur.  DFAS  CPBL  will  ensure  Kansas  City 
Vendor  Pay  personnel  are  aware  of  the  requirements  of  a  proper  invoice  and  of  a  receiving 
report,  and  the  required  documentation  for  miscellaneous  payments  is  available  to  support  the 
payments.  Since  no  fraudulent  or  illegal  payments  were  detected,  DFAS  will  continue  to  use 
judgement  on  returning  invoices  or  receiving  reports  for  minor  flaws  that  do  not  distract  from  the 
validity  of  the  contract,  receiving  report,  and  invoice  being  in  agreement. 


2 


55 


Estimated  Completion  Date:  December  30,  2001. 


Recommendation  B.3.a;  We  recommend  that  the  Director,  Commercial  Pay  Services,  in 
conjunction  with  the  Marine  Corps  develop  stringent  procedures  for  accepting  invoices  receipt 
dates  affixed  outside  the  payment  office.  Procedures  should  ensure  that  the  payment  office  can 
determine  that  the  designated  payment  office  date-stamped  the  invoice. 

DFAS  Management  Comments:  Concur.  The  CPBL  will  coordinate  with  the  Marine  Coqrs  on 
a  procedure  for  how  invoices  are  to  be  date  stamped  and  how  DFAS  will  handle  invoices 
received  from  the  Marine  Corps  without  a  date  stamp. 

Estimated  Completion  Date:  December  30,  2001 


Recommendation  B.3.b:  Return  all  invoices  to  vendors  that  do  not  meet  payment  requirements. 

DFAS  Management  Comments:  Concur.  Kansas  City  Vendor  Pay  site  has  returned  all 
invoices  that  did  not  meet  the  requirements  specified  in  5  C.F.R.  Part  1315.9(b)  of  the  Prompt 
Payment  Act.  A  procedure  has  been  implemented  at  the  Kansas  City  Vendor  Pay  site  to  return 
all  improper  invoices.  The  Marine  Corps  Liaison  Office  was  provided  with  the  required 
information  for  a  proper  invoice  in  April  2001. 

Estimated  Completion  Date:  Action  complete. 


Recommendation  B.3.c;  We  recommend  that  the  Director,  Commercial  Pay  Services,  in 
conjuncdion  with  the  Marine  Corps  develop  and  issue  guidance  to  Marine  Corps  activities 
identifying  the  standards  for  proper  receipt  and  acceptance  of  Government  goods  and  services. 

PFAS_Management  Comments:  Partially  Concur.  DFAS  does  not  develop  and  issue  guidance 
to  the  Marine  Corp  aaivities.  In  April  2001,  DFAS  provided  to  the  Marine  Corp  Liaison  Office 
the  required  information  for  a  proper  receiving  report 

Estimated  Completion  Date:  Marine  Corps  to  provide  response. 

Recommendation  B.3.d:  We  recommend  that  the  Director,  Commercial  Pay  Services,  in 
conjunction  with  the  Marine  Corps,  provide  training  to  personnel  at  receiving  activities  on  the 
importance  of  providing  completed  receiving  reports,  to  payment  offices  within  5  days  of 
acceptance  of  goods  and  services. 

DFAS  Management  Comments:  Partially  Concur.  DFAS  does  not  provide  training  to  Marine 
Corps  activities.  DF  AS  will  assist  the  Marine  Corps  in  the  development  of  any  training 
developed  and  presented  on  the  importance  of  completing  receiving  reports  accurately  and 
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timely  and  providing  the  receiving  reports  to  DFAS  within  5  days  of  acceptance  of  goods  or 
services. 

Estimated  Completion  Pate:  Marine  Corps  to  provide  response. 


Recommendation  C.l!  We  recommend  that  the  Director,  Commercial  Pay  Services,  change  the 
business  structure  and  practices  at  the  Defense  Finance  and  Accounting  Service  Kansas  City  for 
making  vendor  payments  using  the  Computerized  Accounts  Payable  System  for  Windows. 
Specifically  receive  and  date-stamp  all  incoming  documents  supporting  vendor  payments  in  a 
central  location  outside  the  vendor  payment  office, 

DFAS  Management  Comments:  Concur.  The  date-stamp  of  payment  documents  should  not 
be  under  the  control  of  the  Vendor  Pay  Site  Manager.  Kansas  City  Vendor  Pay  Site  Manager 
met  with  the  Logistics  Officer  to  transfer  all  incoming  hard  copy  payment  documents  and  date- 
stamp  equipment  to  the  centralized  maiiroom  on  May  7, 2001. 

Estimated  Completion  Date:  Action  complete. 


Recommendation  C.2:  Establish  a  document  management  section  to  become  the  focal  point  for 
receipt,  screening,  and  control  of  all  documents  supporting  vendor  payments. 

DFAS  Management  Comments:  Concur.  CPBL  is  working  on  a  standard  organization 
structure  for  dl  Vendor  Pay  sites.  The  project  team  reviewing  the  organization  structure  will 
have  as  an  objective  the  requirement  to  establish  organization  and  system  controls  that  ensure 
adequate  separation  of  duties  and  increased  controls  over  documents. 

Estimated  Completion  Date:  March  30,  2002. 


Recommendation  C.3:  Segregate  the  ability  to  enter  information  related  to  invoices  and 
receiving  reports  into  the  Computerized  Accounts  Payable  System  for  Windows  from  the  ability 
to  enter  purchase  order  data.  Alternatively,  segregate  the  ability  to  enter  invoices,  receiving 
reports,  and  obligating  documents  fi:om  the  ability  to  compute  payments. 

DFAS  Management  Comments;  Concur.  The  CPBL  will  review  the  profiles  in  CAPS-W  and 
ensure  adequate  separation  of  duties. 

Estimated  Completion  Date:  December  30, 2001. 


Recommendation  C.4:  Develop  standards  for  entering  invoices  and  receiving  reports  into  the 
Computerized  Accounts  Payable  System  for  Windows. 
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DFAS  Management  Comments:  Concur.  Employees’  standards  will  be  modified  to 
specifically  state  the  quality  and  quantity  of  invoices  and  receiving  reports  to  be  entered  into 
CAPS-W  during  required  timeframes. 

Estimated  Completion  Date:  December  30,  2001. 


Recommendation  C.5:  Organizationally  separate  certification  officials  from  the  accounts 
payable  teams.  Establish  a  separate  section  within  the  vendor  payment  office  for  certification 
officials  who  ensure  that  payments  are  legal,  proper,  and  correct  before  they  are  certified. 

DFAS  Manaeement  Comments:  Concur.  CPBL  is  working  on  a  standard  organization 
structure  for  all  Vendor  Pay  sites.  The  project  team  reviewing  the  organization  structure  will 
have  as  an  objective  the  requirement  to  establish  organization  and  system  controls  that  ensure 
adequate  separation  of  duties  and  increased  controls  over  certification  duties. 

Estimated  Completion  Date:  March  30,  2002. 


Recommendation  C.d:  Certify  all  individual  vendor  payments  until  a  sampling  plan  for 
certifying  a  representative  sample  of  contract  and  miscellaneous  payments  is  developed  and 
approved. 

DFAS. Management  Comments:  Partially  Concur.  DFAS  will  implement  the  pre- and  post- 
payment  reviews  based  on  the  current  DFAS  Arlington  statistical  sample  guidance  that  is  in 
coordination. 

Estimated  Completion  Date:  December  30,  2001. 


Recommendation  C.7:  Designate  individuals  to  review  reports  that  indicate  problems  with 
documents  needed  to  support  payments  and  work  with  customers  to  receive  missing  information 
Establish  a  reports  and  reconciliation  section  to  handle  payment  anomalies  and  reconcile  system 

rpnoT+c  ^ 


FAS  Management  Comments:  Concur.  Reports  are  generated  to  identify  invoices  missing 
reiving  reports  and  obligations.  Supervisors  review  these  reports  before  disseminating  them  to 
the  M^me  Corps  Liaison  Office.  DFAS  Kansas  Oty  Vendor  Pay  Supervisors  will  coordinate 
With  the  Marine  Corps  Liaison  Office  to  obtain  missing  documents. 

Estimated  Completion  Date:  October  30,  2001. 


Re.c_qmmendation  C.8:  Perform  monthly  post-payment  voucher  reviews  to  ensure  that  vendor 
payments  are  properly  supported  and  to  identify  problem  areas. 


5 


58 


DFAS  Management  Comments;  Partially  Concur.  Post-payment  reviews  will  revert  to 
monthly  if  the  quarterly  reviews  result  in  an  unacceptable  level  of  compliance. 

Estimated  Completion  Pate:  October31,  2001. 


Recommendation  C.9:  Develop  a  comprehensive  training  program  for  making  property 
supported  vendor  payments. 

DFAS  Management  Comments:  Concur.  Training  personnel  at  the  Kansas  City  Vendor  Pay 
Site  developed  a  new  employee  training  program  in  January  2001.  Refresher  training  on  items 
identified  during  this  audit,  such  as  interest  computation/allocation,  missing  receiving  reports, 
and  valid  supporting  documentation,  has  been  provided  to  Vendor  Pay  personnel.  The  training 
program  will  be  reviewed  to  ensure  it  meets  all  the  requirements  identified  since  establishment  of 
the  CPBL. 

Estimated  Completion  Date:  December  30,  2001. 
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